Privacy Policy
As of: November 2026
Erato Labs GmbH (hereinafter "we", "us") is pleased about your visit to our website www.eratolabs.com (hereinafter "Website"). We only collect the data that we need to operate the website and to communicate with you. Below, in accordance with Art. 13 and 14 GDPR, we inform you about which data we process, for what purpose, and on what legal basis.
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Erato Labs GmbH
Oberfeld 54
82319 Starnberg
Germany
Phone: +49 30 16634414
Email: contact@eratolabs.com
Represented by Managing Directors Daniel Person and Sabrina Person.
For data protection-related inquiries or to exercise your rights, you can reach us at any time by email at privacy@eratolabs.com.
Data Protection Officer
We have appointed an external Data Protection Officer:
Kertos GmbH
Brienner Straße 41
80333 Munich
Germany
Email: dataprivacy@kertos.io
What is personal data?
Personal data is any information relating to an identified or identifiable natural person, such as name, email address, or IP address. Information that does not allow any connection to your person, for example because it is anonymized, is not personal data. Any processing of personal data requires a legal basis.
Provision of the website and server log files
Scope and purpose. When accessing the website, your browser automatically transmits data to the server, which is temporarily stored in log files:
IP address of the requesting device
Date and time of access
Name and URL of the retrieved page
Website from which the access is made (referrer URL)
Browser used and operating system
We process this data to deliver the website, ensure a stable connection, and for IT security purposes.
Legal basis. Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and functional provision of the website.
Storage duration. The data will be deleted as soon as it is no longer required for these purposes.
Hosting via Framer
Our website is created and hosted using Framer. The provider is Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands. Framer processes the above-mentioned access data on our behalf. A data processing agreement according to Art. 28 GDPR exists with Framer (Framer Data Processing Addendum).
Framer uses sub-processors for hosting and delivery, some of which are based in the USA. For safeguards, see the "Third country transfers" section.
Legal basis. Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in a reliable and secure presentation of our website.
Audience measurement with Framer Analytics
In order to statistically evaluate the use of our website, we use Framer's integrated audience measurement. Aggregated values such as page views, referral pages, device type, and approximate region are recorded.
Framer Analytics does not set cookies and does not store persistent identifiers on your device. Your IP address is only processed in hashed form; the key used for this is deleted daily. It is therefore not possible for us to draw conclusions about your person (Framer: GDPR and cookies).
Legal basis. Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in improving our offering. Since no information is stored on or read from your end device, consent under Section 25 TDDDG is not required.
Objection. You can object to the processing at any time, e.g., by email to privacy@eratolabs.com.
Cookies
Our website does not use cookies and does not store any information in your browser (e.g., local storage). Therefore, there is also no cookie banner. Should we change this in the future, we will update this privacy policy and obtain your consent where necessary.
Contact by email or phone
When you contact us by email or phone, we process your information (e.g., name, email address, company, content of the inquiry) to respond to your inquiry.
Legal basis. Art. 6 para. 1 lit. b GDPR, if your inquiry aims at concluding a contract or pre-contractual measures; otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in answering inquiries).
Storage duration. We delete your data when the inquiry has been conclusively handled and there are no statutory retention obligations (e.g., under the German Commercial Code (HGB) or German Fiscal Code (AO) for business correspondence) to the contrary.
Our company page on LinkedIn
We operate a company page on LinkedIn (linkedin.com/company/erato-labs). The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
When you visit or interact with our page, LinkedIn processes your data and provides us with anonymized statistics ("Page Insights"). For this processing, we and LinkedIn are joint controllers pursuant to Art. 26 GDPR. The agreement can be found here: LinkedIn Page Insights Joint Controller Addendum. According to this, LinkedIn is primarily responsible for providing information to data subjects and fulfilling their rights. However, you can also contact us with inquiries.
Further information about data processing by LinkedIn can be found in the LinkedIn Privacy Policy.
Legal basis. Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in communicating with customers, interested parties, and applicants.
Links to other websites
Our website contains links to LinkedIn and GitHub. These are simple links; no data is transferred to these providers when you visit our website. The privacy policies of the respective provider only apply once you click on a link.
Recipients of personal data
Within our company, only those persons who need your data for the stated purposes are granted access to it. External recipients are:
Processors: carefully selected service providers, in particular for hosting (Framer) and email and office communications (Google Workspace). They only process data according to our instructions and based on a contract pursuant to Art. 28 GDPR.
Public authorities: public authorities, courts, or tax authorities, to the extent that we are legally obliged to do so.
Third country transfers
We generally process your data within the EU or the European Economic Area (EEA). Some service providers or their sub-processors are based in third countries, particularly in the USA. A transfer only takes place if the requirements of Art. 44 et seq. GDPR are met, i.e. if:
the EU Commission has determined an adequate level of data protection (for the USA: EU-US Data Privacy Framework, provided the recipient is certified), or
EU standard contractual clauses have been agreed upon, where applicable with additional protective measures.
Storage duration
We only store personal data for as long as is necessary for the respective purpose. Afterward, we delete or restrict access to it, unless statutory retention obligations prevent this. The specific periods are stated in the individual processing activities above.
Data security
We protect your data through technical and organizational measures against loss, manipulation, and unauthorized access, continuously adapting them to the state of the art. The website is delivered exclusively encrypted (HTTPS). Please note that unencrypted emails can be read by third parties during transmission.
Your rights
You have the following rights regarding your personal data with respect to us:
Access (Art. 15 GDPR): whether and which data we process about you, for what purpose, to whom, and for how long.
Rectification (Art. 16 GDPR): have inaccurate data corrected and incomplete data completed.
Erasure (Art. 17 GDPR): e.g., if the data is no longer necessary for the purpose or has been unlawfully processed.
Restriction of processing (Art. 18 GDPR): e.g., while the accuracy of your data is being verified.
Data portability (Art. 20 GDPR): receive your data in a structured, commonly used, and machine-readable format.
Withdrawal of consent (Art. 7 para. 3 GDPR): at any time with effect for the future.
Right to object (Art. 21 GDPR). If we process your data on the basis of Art. 6 para. 1 lit. f GDPR, you can object at any time for reasons arising from your particular situation. You can object to direct marketing at any time without giving reasons.
To exercise your rights, simply send an email to privacy@eratolabs.com.
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht - BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.
Changes to this privacy policy
We review this privacy policy at least once a year and whenever changes are made to our website or the services used. The version published here applies in each case.