Datenschutzerklärung

Deutsche Kurzfassung

Verantwortlicher. VxLabs GmbH, 8 The Green, Suite B, Dover, DE 19901, USA. Europäische Vertretung nach Art. 27 DSGVO: VxLabs GmbH, Regensburg, Deutschland (siehe Impressum).

Erhobene Daten. Formulareingaben (Name, E-Mail, Unternehmen), Nutzungsdaten Ihres ThreatZ-Kontos, technische Log-Daten (IP, User-Agent, Seitenaufrufe). Analyse- und Marketing-Cookies werden erst nach Ihrer Einwilligung über unseren Cookie-Banner gesetzt.

Rechtsgrundlagen. Art. 6 Abs. 1 lit. b DSGVO (Vertragserfüllung, Demo-/Trial-Anfragen), lit. f (berechtigtes Interesse, Websitesicherheit), lit. a (Einwilligung für Analyse, Marketing, HubSpot-Tracking).

Auftragsverarbeiter. HubSpot (CRM, EU1-Region), Microsoft Azure (Hosting), Google (Tag Manager / Analytics), Apollo.io und Claydar (B2B-Besucher-Identifikation — nur nach Einwilligung), Google Fonts (Schriftarten-CDN).

Ihre Rechte (Art. 15–22 DSGVO). Auskunft, Berichtigung, Löschung ("Recht auf Vergessen"), Einschränkung, Datenübertragbarkeit, Widerspruch, Beschwerde bei einer Aufsichtsbehörde (in Deutschland: BfDI). Einwilligungen können jederzeit mit Wirkung für die Zukunft widerrufen werden.

Speicherdauer. Personenbezogene Daten werden nur so lange gespeichert, wie dies für die jeweiligen Zwecke erforderlich ist oder gesetzliche Aufbewahrungspflichten bestehen (typischerweise 6–10 Jahre für steuerlich relevante Unterlagen).

Internationale Datenübermittlung. Übermittlungen in die USA erfolgen auf Basis des EU-US Data Privacy Framework (DPF) sowie Standardvertragsklauseln (SCCs) gemäß Art. 46 DSGVO.

Kontakt Datenschutzbeauftragter (DPO). dpo@vxlabs.ai

---

English Full Policy

VxLabs GmbH ("VxLabs", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website vxlabs.ai and use our ThreatZ product. This policy is provided in accordance with the EU General Data Protection Regulation (GDPR) Art. 13 and Art. 14 information obligations, the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

VxLabs GmbH
8 The Green, Suite B
Dover, DE 19901, USA
Email: info@vxlabs.ai
Website: https://vxlabs.ai

2. Data Protection Officer (DPO)

You can contact our Data Protection Officer for any questions regarding the processing of your personal data or to exercise your data subject rights:

Data Protection Officer
Email: dpo@vxlabs.ai

3. EU Representative (Art. 27 GDPR)

As VxLabs GmbH is established outside the European Union, we have appointed an EU representative pursuant to Art. 27 GDPR:

VxLabs GmbH
Franz-Mayer-Str. 1
93053 Regensburg, Germany
Email: dpo@vxlabs.ai

4. Information We Collect

We collect the following categories of personal data:

4.1 Information you provide directly:

• Account & contact data: Name, email address, company name, job title, phone number — when you register for a trial, request a demo, subscribe to our newsletter, or contact us.
• Form submissions: Any information you enter into HubSpot-powered forms on our site (demo requests, one-pager downloads, service inquiries).
• Communication data: Content of emails and messages you send us.

4.2 Information collected automatically:

• Usage data: IP address, browser type and version, operating system, referring URL, pages visited, time spent on pages, click patterns.
• Device data: Screen resolution, device type, language preference.
• Cookie data: See Section 8 (Cookies) below for a detailed listing.

5. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data based on the following legal grounds:

Where we rely on legitimate interests, our interests include operating and improving our services, ensuring network and information security, and preventing fraud. These interests are balanced against your fundamental rights and freedoms.

6. How We Use Your Information

We use collected information to:

• Provide and maintain our services, including the ThreatZ platform
• Create and manage your account
• Communicate with you about your account, support requests, and service updates
• Send product updates and marketing communications (with your consent, which you can withdraw at any time)
• Improve our products, website, and user experience
• Analyze usage patterns and optimize performance
• Prevent fraud and ensure security
• Comply with legal obligations

7. Data Sharing and Third-Party Processors

We do not sell your personal data. We may share information with the following categories of recipients:

7.1 Sub-processors:

7.2 Other disclosures:

• Business partners: Only with your explicit consent.
• Legal authorities: When required by law, court order, or to protect our legal rights.
• Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified).

8. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. You can manage your cookie preferences through our cookie consent banner, which appears on your first visit. You can change your preferences at any time by clicking "Cookie Settings" in the footer.

8.1 Essential Cookies (always active, no consent required)

8.2 Analytics / Marketing Cookies (require consent)

HubSpot cookies are only loaded when you accept analytics cookies via our consent banner. Google Analytics cookies are loaded via Google Tag Manager and are also gated by the same consent mechanism. If you choose "Essential Only," no HubSpot or Google Analytics scripts or cookies are loaded.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States. We ensure adequate protection for such transfers through the following mechanisms:

• EU-US Data Privacy Framework (DPF): Where applicable, our processors (including HubSpot and Microsoft) are certified under the EU-US Data Privacy Framework, providing an adequate level of data protection as recognized by the European Commission.
• Standard Contractual Clauses (SCCs): We have executed Standard Contractual Clauses approved by the European Commission with all processors that transfer data outside the EEA.
• Supplementary measures: We implement additional technical (encryption in transit and at rest) and organizational measures to ensure the security of transferred data.

10. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods are as follows:

You may request early deletion of your data at any time by contacting dpo@vxlabs.ai, subject to legal retention obligations.

11. Your Rights (GDPR)

Under the GDPR and applicable data protection laws, you have the following rights:

• Right of access (Art. 15): Obtain confirmation of whether we process your personal data and request a copy.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): Request restriction of processing of your personal data.
• Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests, including profiling.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, please contact our DPO at dpo@vxlabs.ai. We will respond within 30 days of receipt of your request.

12. Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority. You may contact:

• The supervisory authority in your EU/EEA member state of habitual residence or place of work, or
• The Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) — Bavarian Data Protection Authority (as VxLabs GmbH is located in Regensburg, Bavaria):
  Promenade 18, 91522 Ansbach, Germany
  Website: https://www.lda.bayern.de
  Email: poststelle@lda.bayern.de

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to know what personal information we collect, use, disclose, and sell (if applicable) about you.
• Right to Delete: You have the right to request deletion of personal information we have collected from you.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information as defined under the CCPA/CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond what is necessary to provide our services.

Categories of personal information collected in the preceding 12 months:

• Identifiers (name, email, IP address)
• Commercial information (subscription records, purchase history)
• Internet or electronic network activity (browsing history, interaction with our website)
• Professional or employment-related information (company, job title)

To exercise your California privacy rights, contact us at privacy@vxlabs.ai or dpo@vxlabs.ai. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

14. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective Date" at the top of this page and, where appropriate, by providing additional notice (such as a banner on our website or an email notification). We encourage you to review this policy periodically.

16. Contact

For any questions or concerns about this Privacy Policy or our data practices:

VxLabs GmbH
8 The Green, Suite B
Dover, DE 19901, USA
General inquiries: info@vxlabs.ai
Privacy inquiries: privacy@vxlabs.ai
Data Protection Officer: dpo@vxlabs.ai

EU Representative:
VxLabs GmbH
Franz-Mayer-Str. 1
93053 Regensburg, Germany
Email: dpo@vxlabs.ai