Legal
Privacy Policy
This policy explains how Kosmia Labs processes personal data when you use this website, in line with the EU General Data Protection Regulation (GDPR).
01 — Data controller
The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:
Kosmia Labs
An independent software lab, operated by an individual developer
[email protected]
Kosmia Labs is not a registered company. No data protection officer has been appointed; none is required for a lab of this size and the processing described in this policy.
02 — Data we collect
When you visit this website, our hosting provider automatically records technical information in server log files. This typically includes the requested page, the date and time of the request, the referring URL, the browser type and version, the operating system, and an abbreviated or full IP address.
Beyond this, we only process data that you actively provide, for example when you submit the contact form or write to us by email.
03 — Legal bases
Processing of technical log data is based on our legitimate interest in operating a secure and functional website (Art. 6(1)(f) GDPR). Processing of enquiries is based on pre-contractual or contractual measures (Art. 6(1)(b) GDPR) or on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future.
04 — Advertising
This website displays advertising served by Google AdSense, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA). Google and its advertising partners use cookies and similar technologies to serve ads, measure their performance, and — where you have consented — personalise them based on your prior visits to this and other websites.
For visitors in the European Economic Area, the United Kingdom, and Switzerland, consent is collected through Google's certified consent message before any consent-requiring advertising cookies are set. You can change or withdraw your choices at any time via the “Privacy & ad settings” link in the footer of this website.
You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, read Google's privacy policy at policies.google.com/privacy, and manage ad personalisation at adssettings.google.com. Opt-out options for other advertising partners are available at aboutads.info.
No separate analytics service (such as Google Analytics) is currently used on this website. If one is added, this section will be updated before it goes live.
06 — Contact forms and enquiries
If you contact us through the form or by email, the details you provide, including your name, email address, organisation and message, are stored for the purpose of handling your enquiry and any follow-up questions. We do not use this data for unrelated purposes and do not pass it on without your consent.
Form submissions are delivered to us by Formspree, Inc. (USA), which processes the submitted data solely to forward it to our inbox. Formspree's privacy policy is available at formspree.io/legal/privacy-policy.
07 — Hosting and third-party services
This website uses the following service providers:
Firebase Hosting / Google Cloud (Google LLC, USA) — hosts and delivers this website and records standard server request logs. Google Fonts — the fonts used on this site are loaded from Google's servers (fonts.googleapis.com, fonts.gstatic.com), which means your IP address is transmitted to Google when a page loads. Google AdSense — serves advertising as described in section 04. Formspree, Inc. (USA) — delivers contact-form submissions as described in section 06.
These providers process data under their standard published data-processing and privacy terms, linked from the relevant sections of this policy.
08 — International data transfers
The providers listed above are based in, or transfer data to, the United States. Where a processor is located outside the European Economic Area, transfers take place on the basis of an adequacy decision (including the EU–US Data Privacy Framework, where the provider is certified) or EU standard contractual clauses under Art. 46 GDPR, as set out in each provider's published terms.
09 — Data retention
Personal data is retained only as long as necessary for the purpose it was collected for, or as long as statutory retention obligations require. Server request logs are retained by our hosting provider for a limited period determined by Google's standard log-retention practices. Enquiry correspondence is deleted once the matter is concluded, and in any case within twelve months, unless legal obligations prevent deletion.
10 — Your rights under the GDPR
You have the right to request information about the personal data we hold about you (Art. 15), to have inaccurate data corrected (Art. 16), to request erasure (Art. 17), to request restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21).
You also have the right to lodge a complaint with a supervisory authority, in particular the data protection authority of the member state of your residence, place of work, or the place of the alleged infringement.
11 — Security
This website uses TLS encryption for all connections. We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and review them as our systems change.
12 — Changes to this policy
We update this policy when our services or the legal requirements change. The version published on this page always applies, together with the effective date shown above.
13 — Contact
For any question about this policy or to exercise your rights, use the contact form or write to [email protected].
Contact Kosmia Labs →