Imprint

Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

Systems Lab 21 GmbH
August-Bebel-Str. 88
14482 Potsdam
Germany

We are not required to appoint a data protection officer. For any question about this notice or your data, please write to privacy@systemslab21.com.

Your rights

In respect of the personal data we hold about you, you have the right to:

• access (Art. 15 GDPR) - to be told whether and which data we process about you, and to receive a copy;
• rectification (Art. 16 GDPR) - to have inaccurate data corrected and incomplete data completed;
• erasure (Art. 17 GDPR) - to have your data deleted where one of the grounds in the article applies;
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR) - to receive data you provided in a structured, commonly used, machine-readable format;
• object (Art. 21 GDPR) - to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests;
• withdraw consent (Art. 7 (3) GDPR) - where processing rests on your consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, an informal message to privacy@systemslab21.com is enough.

Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany

Visiting the website: server log files

When you call up a page, your browser automatically transmits data that our hosting provider records in server log files. This covers the requested file, the browser type and version, the operating system, the referring URL, the time of the request and the IP address.

Legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is delivering the site reliably, and recognising and investigating attacks and technical faults. This data is not merged with other sources and is not used to identify you.

Log files are deleted by our hosting provider after a short period, at the latest after seven days.

Hosting

This website is a static export hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data described under server log files on our behalf as a processor under Art. 28 GDPR. The servers are located in Germany.

The Platform21 application is operated on Microsoft Azure, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data described under Platform21 accounts and sign-in on our behalf as a processor under Art. 28 GDPR. The application runs in data centres in the European Union. Microsoft may involve sub-processors outside the EU for support and operations; those transfers rest on the EU standard contractual clauses, and Microsoft Corporation is certified under the EU-US Data Privacy Framework.

Cookies and consent

The website itself does not need cookies to work. Cookies are set only by the web analytics described in the next section, and only once you accept them in the banner. Your choice is stored locally in your browser so that the banner does not reappear on every visit.

Storing and reading information on your device requires your consent under section 25 (1) TDDDG; the subsequent processing of the personal data rests on Art. 6 (1) (a) GDPR.

You can withdraw your consent at any time with effect for the future by clearing this site's data in your browser, which makes the banner appear again on your next visit.

Web analytics: Google Analytics and Google Tag Manager

Subject to your consent, we use Google Analytics 4 and Google Tag Manager, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use them to understand which pages are read and how visitors find them, so that we can improve the site. Google Tag Manager itself only manages the loading of tags; it does not create profiles of its own.

Legal basis is your consent under Art. 6 (1) (a) GDPR and section 25 (1) TDDDG. Analytics does not run unless you accept it.

Data may be transferred to Google LLC in the United States. Google relies on the EU standard contractual clauses and on the EU-US Data Privacy Framework, under which Google LLC is certified. A transfer to a third country nevertheless carries the residual risk that authorities there access the data.

Analytics data is deleted by Google after 14 months at the latest.

You may withdraw your consent at any time with effect for the future; see the section on cookies and consent above.

Contact form and newsletter

The contact form and the newsletter form on this site are handled by Getform (Getform, Inc.), a form backend that receives the details you enter - typically your name, email address, company and your message - and forwards them to us by email.

Where you contact us about a contract or its initiation, the legal basis is Art. 6 (1) (b) GDPR; otherwise it is our legitimate interest in answering enquiries under Art. 6 (1) (f) GDPR. Newsletter registration rests on your consent under Art. 6 (1) (a) GDPR and can be withdrawn at any time.

Getform processes the submissions on our behalf. Processing may take place in the United States on the basis of standard contractual clauses.

We keep enquiries for as long as they are needed to deal with your request and to meet statutory retention periods, then delete them.

Providing this data is neither required by law nor by contract. Without it, however, we cannot answer your enquiry.

Platform21 accounts and sign-in

This notice also applies to the Platform21 application at platform21.app, which is referenced back to this page. Using the application requires an account. We process the registration details you provide - your name, your email address and the organisation you work for - together with authentication data and a record of your sign-ins.

You can sign in with an email address and password, with a GitHub account, or through your organisation's own identity provider using SAML or OpenID Connect. Where you sign in through GitHub or your organisation, we receive only the identifying data that provider releases to us, typically your name and email address. We never receive your password from those providers.

While you use the application, we process the configurations, test setups and test results you create in it, together with technical log data needed to operate the service securely and to investigate faults.

Legal basis is Art. 6 (1) (b) GDPR: the processing is necessary to provide the service you registered for. The same basis covers pre-contractual use, such as a trial or the sandbox.

Account data is kept for as long as the account exists. After you or your organisation closes an account, we delete the account data and the content belonging to it, subject to statutory retention periods.

Job applications

Applications reach us by email at the address given in the job advertisement. We process the documents and details you send in order to decide on your application.

Legal basis is Art. 6 (1) (b) GDPR together with section 26 (1) BDSG.

If your application is unsuccessful, we delete your documents at the latest six months after the process ends, unless you have agreed to a longer period so that we can consider you for future openings.

Recipients and processors

We pass personal data on only where necessary. Recipients are:

• Hetzner Online GmbH (hosting, Germany) - processor under Art. 28 GDPR;
• Microsoft Ireland Operations Limited (Microsoft Azure, hosting of the Platform21 application) - processor under Art. 28 GDPR;
• Getform, Inc. (form submissions) - processor;
• Google Ireland Limited (web analytics), only with your consent;
• GitHub, Inc. or your organisation's identity provider, where you choose to sign in to Platform21 through them;
• public bodies where we are legally obliged to disclose data.

We do not sell personal data and do not use it for automated advertising profiles.

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Changes to this notice

We update this notice when the processing described here changes or when the legal position requires it. The current version always applies and carries the date shown at the top.