Data policy

Privacy Policy

Personal data (hereinafter generally referred to as “data”) are processed by us only to the extent necessary and for the purpose of providing a functional and user-friendly website, including its content and the services offered there.

Pursuant to Art. 4(2) of Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter “GDPR”), “processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The following Privacy Policy provides information in particular about the nature, scope, purpose, duration and legal basis of the processing of personal data insofar as we determine the purposes and means of processing either alone or jointly with others. We also provide information about third-party components used for optimisation purposes and to improve the quality of use where third parties process data under their own responsibility.

Our Privacy Policy is structured as follows:

I. Information about us as the controller
II. Rights of users and data subjects
III. Information about data processing

I. Information about us as the controller

The controller responsible for this website within the meaning of data protection law is:

BOXLAB Services GmbH
Mundenheimer Str. 100 · D 67061 Ludwigshafen am Rhein

Phone: +49 621 5820 6965

Email: info@boxlab-services.com

II. Rights of users and data subjects

With regard to the data processing described in more detail below, users and data subjects have the right

to obtain confirmation as to whether personal data concerning them are being processed, access to the processed data, further information about the processing and copies of the data (see also Art. 15 GDPR);
to rectification or completion of inaccurate or incomplete data (see also Art. 16 GDPR);
to the immediate erasure of data concerning them (see also Art. 17 GDPR) or, alternatively, where further processing is required pursuant to Art. 17(3) GDPR, to restriction of processing in accordance with Art. 18 GDPR;
to receive the data concerning them which they have provided and to transmit those data to other providers/controllers (see also Art. 20 GDPR);
to lodge a complaint with a supervisory authority if they consider that data concerning them are being processed by the provider in breach of data protection law (see also Art. 77 GDPR).

In addition, the provider is obliged to inform all recipients to whom data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out pursuant to Articles 16, 17(1) and 18 GDPR. This obligation does not apply where such notification proves impossible or involves disproportionate effort. Irrespective of this, the user has the right to information about those recipients.

Users and data subjects also have the right under Art. 21 GDPR to object to future processing of data concerning them where the provider processes the data pursuant to Art. 6(1)(f) GDPR. In particular, an objection to processing for direct marketing purposes is permissible.

III. Information about data processing

Data processed when you use our website will be erased or blocked as soon as the purpose for storage ceases to apply, provided that no statutory retention obligations prevent erasure and no different information is provided below for individual processing operations.

Server Data & Hosting

For technical reasons, particularly to ensure a secure and stable website, data are transmitted to us or our web hosting provider by your internet browser. These server log files collect information including the type and version of your internet browser, your operating system, the website from which you accessed our website (referrer URL), the pages of our website that you visit, the date and time of each access, and the IP address of the internet connection from which our website is accessed.

The data collected in this way are stored temporarily but are not combined with other personal data concerning you.

This storage is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in improving the stability, functionality and security of our website.

The data are deleted after seven days at the latest, unless further retention is necessary for evidentiary purposes. In such cases, the data are excluded from deletion, either in whole or in part, until the incident has been conclusively resolved.

We host our website with All-Inkl. The provider is ALL-INKL.COM – Neue Medien Münnich, owned by René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (hereinafter “All-Inkl”). Details can be found in All-Inkl’s privacy policy:
https://all-inkl.com/datenschutzinformationen/.
The use of All-Inkl is based on Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.
Source:
https://www.e-recht24.de

Cookies and Consent Management with Borlabs Cookie

Our website uses cookies and comparable technologies. Cookies are small text files that may be stored on your terminal device. Comparable technologies may also be used to store information on your terminal device or access information stored on it.

We use the consent management system Borlabs Cookie to obtain, manage and document your consent for services and technologies that require consent.

When you first visit our website, you can use the displayed consent banner to select the categories of services to which you wish to consent. Services and technologies that are not strictly necessary for the operation of the website are generally activated only after you have given your corresponding consent.

Technically necessary cookies and comparable technologies may be used without prior consent insofar as they are strictly necessary to provide a digital service expressly requested by you. The legal basis for accessing or storing information on your terminal device in such cases is Section 25(2) TDDDG. Where personal data are processed in this context, the legal basis depends on the respective purpose of processing.

For all services that are not technically necessary and involve storing information on or accessing information from your terminal device, processing is based on your consent pursuant to Section 25(1) TDDDG. Where personal data are processed in this context, processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

Your consent is voluntary and may be changed or withdrawn at any time with effect for the future through the privacy settings on our website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The privacy settings also provide further information about the services used, their purposes, providers, storage periods, and the cookies and comparable technologies used.

Further information about Borlabs Cookie is available at:

https://borlabs.io/borlabs-cookie/

Security Notice and Storage of Your Choice

Our website displays a security notice about fraudulent emails sent in our name. You can close this notice using X, “Close” or the Escape key without storing your choice.

Only if you explicitly select “Do not show for 30 days” does BOXLAB Services GmbH store the cookie boxlab_security_notice_20261105_v2 with the value dismissed on your device. Its sole purpose is to hide the security notice in this browser on this website for 30 days. The cookie contains no unique visitor ID and is not used by the plugin for advertising or analytics.

The storage and subsequent access are based on your consent pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Your choice is voluntary. You can withdraw it at any time with effect for the future using the button below. Withdrawal does not affect the lawfulness of storage or access that took place before withdrawal.

This choice is made separately within the security notice and is not managed by the switches in the Borlabs cookie dialog.

Newsletter and rapidmail

If you subscribe to our newsletter, we process the data you provide during registration, particularly your email address and any additional information you voluntarily provide, in order to send you our newsletter.

Registration generally takes place using a double opt-in procedure. After registering, you will receive an email asking you to confirm your subscription. This is intended to prevent third parties from registering email addresses belonging to other people. In connection with registration, the date and time of registration and confirmation, as well as technical information such as your IP address, may be processed in order to provide evidence that registration was carried out properly.

We use rapidmail to send and technically manage our newsletters. The provider is rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau, Germany.

The data you provide when subscribing to the newsletter are transmitted to rapidmail and processed there on our behalf. We have concluded a corresponding data processing agreement with the provider.

The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR. Where newsletters are sent to existing customers in accordance with statutory requirements, they may be sent on the basis of Section 7(3) of the German Act Against Unfair Competition (UWG).

Our newsletters may contain functions for statistical analysis. For example, we may analyse whether a newsletter has been opened and which links contained in it have been clicked. We use this information to improve the delivery and content of our newsletters.

Where this analysis is based on your consent, the legal basis is Art. 6(1)(a) GDPR.

You may withdraw your consent to receiving newsletters at any time with effect for the future. In particular, you can use the unsubscribe link included in every newsletter. The lawfulness of processing carried out before withdrawal remains unaffected.

After you unsubscribe, your data will be removed from the active newsletter mailing list, unless another legal basis or statutory retention obligation requires further storage.

External Fonts in Newsletters

Depending on the design of the respective newsletter, external fonts, such as Google Fonts, may be used. Opening a newsletter designed in this way may establish a connection to the servers of the respective provider. In this context, technical information such as your IP address, details of the device and browser used, and the time of access may be processed.

Whether such a connection is established depends on the specific design of the newsletter and the email program used, including its settings.

Where Google services are used in this context, data may also be processed outside the European Union or the European Economic Area.

Further information about the processing of personal data by Google is available at:

https://policies.google.com/privacy

Further information about the processing of personal data by rapidmail is available at:

https://www.rapidmail.de/datenschutz

Information about data security at rapidmail is available at:

https://www.rapidmail.de/datensicherheit

Contact Requests / Contact Options

If you contact us using a contact form, email, telephone or other means, we process the personal data you provide in order to handle and respond to your enquiry.

Where your enquiry relates to the initiation or performance of a contract, processing is based on Art. 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in appropriately handling and responding to enquiries pursuant to Art. 6(1)(f) GDPR.

Your data will be deleted once your enquiry has been conclusively handled, provided that no statutory retention obligations or other legitimate reasons prevent further storage.

Online Job Applications / Publication of Job Vacancies

We offer you the opportunity to apply for positions with us through our website. In the case of these digital applications, we electronically collect and process your applicant and application data for the purpose of conducting the recruitment process.

The legal basis for this processing is Section 26(1), sentence 1, of the German Federal Data Protection Act (BDSG) in conjunction with Art. 88(1) GDPR.

If an employment contract is concluded following the application process, we store the data submitted with your application in your personnel file for the purposes of normal organisational and administrative processes, while observing all applicable additional legal obligations.

The legal basis for this processing is also Section 26(1), sentence 1, BDSG in conjunction with Art. 88(1) GDPR.

In the event of an unsuccessful application, the data processed during the application procedure will generally be deleted as soon as their continued storage is no longer necessary for the application process. Longer storage may take place, particularly where this is necessary for the establishment, exercise or defence of legal claims or where statutory retention obligations apply.

The legal basis for processing for the establishment, exercise or defence of legal claims is Art. 6(1)(f) GDPR. Our legitimate interest lies in defending or enforcing legal rights.

If you expressly consent to longer storage of your data, for example for inclusion in an applicant or prospective candidate database, the data will continue to be processed on the basis of your consent. The legal basis is Art. 6(1)(a) GDPR. You may withdraw your consent at any time pursuant to Art. 7(3) GDPR by notifying us, with effect for the future.

Social Media Presences and Links

We maintain publicly accessible company profiles on social networks and provide links to these profiles on our website. Our social media presences are used in particular to present our company and services, publish information and news, and communicate with customers, prospective customers and other users.

Links on Our Website

Links to our social media profiles are generally provided as simple hyperlinks or linked graphics. Merely visiting our website does not cause content from the respective social networks to be loaded, nor does it establish a connection to the servers of the respective platform operators solely as a result of these links.

Only when you click on a corresponding link will you be redirected to the website of the respective social network. From that point onwards, the relevant platform operator may process personal data concerning you.

This should be distinguished from social network content embedded directly into our website, such as embedded videos. Where such content is used, we provide separate information about it in this Privacy Policy.

YouTube

We maintain a company presence on YouTube to present our company and services, publish information and content, and communicate with users.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

YouTube is operated by Google.

When you visit our YouTube presence, Google may process personal data. This may include your IP address, information about your browser and terminal device, and information about your use of and interactions with YouTube.

If you are logged into Google or YouTube during your visit, the information collected may be associated with your user account. Google may also process the collected data for its own purposes, particularly to analyse user behaviour and to provide and personalise content and advertising.

We have only limited influence over the nature and extent of Google’s independent processing activities.

Further information about the processing of personal data by Google and YouTube is available at:

https://policies.google.com/privacy

We maintain a company presence on LinkedIn to present our company and services, publish information and content, and communicate with customers, prospective customers and other users.

The provider is:

LinkedIn Ireland Unlimited Company
Wilton Plaza
Wilton Place
Dublin 2
Ireland

When you visit our LinkedIn presence, LinkedIn may process personal data. This may include your IP address, information about your browser and terminal device, and information about your use of and interactions with LinkedIn.

If you are logged into LinkedIn during your visit, the information collected may be associated with your LinkedIn user account.

LinkedIn may also process the collected data for its own purposes, particularly to analyse user behaviour, provide and improve its services, and conduct advertising and market research. We have only limited influence over the nature and extent of this independent processing by LinkedIn.

Further information about the processing of personal data by LinkedIn is available at:

https://www.linkedin.com/legal/privacy-policy

Facebook

We maintain a company presence on Facebook to present our company and services, publish information and content, and communicate with customers, prospective customers and other users.

The provider is:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

When you visit our Facebook presence, Meta may process personal data. This may include your IP address, information about your browser and terminal device, and information about your use of and interactions with Facebook.

If you are logged into Facebook during your visit, the information collected may be associated with your Facebook user account.

Meta may process the information collected for its own purposes, particularly to analyse user behaviour, create user profiles, and provide and personalise content and advertising.

In connection with our Facebook page, Meta also provides us with statistical information about the use of our page (“Page Insights”). We may be jointly responsible with Meta under data protection law for certain processing activities involving Page Insights data.

The agreement on joint controllership for Page Insights is available at:

https://www.facebook.com/legal/terms/page_controller_addendum

Further information about the processing of personal data by Meta is available at:

https://www.facebook.com/privacy/policy/

Legal Bases for Our Social Media Presences

Where we process personal data ourselves in connection with our social media presences, this processing is based on our legitimate interest in presenting our company to the public, providing information about our services, and communicating with customers, prospective customers and other users pursuant to Art. 6(1)(f) GDPR.

Where processing is necessary for the initiation or performance of a contract, it is based on Art. 6(1)(b) GDPR.

Where consent is obtained for a specific processing activity, processing is based on Art. 6(1)(a) GDPR. Consent may be withdrawn with effect for the future.

Contact via Social Networks

If you contact us through one of our social media profiles, we process the data you provide in order to handle and respond to your enquiry.

The data we process in this context will be deleted once the respective enquiry has been conclusively handled, provided that no statutory retention obligations or other legitimate reasons prevent further storage.

Processing by Platform Operators and Third-Country Transfers

The respective platform operators also process personal data under their own responsibility as data controllers. In particular, information about user behaviour may be collected, analysed and used for the operators‘ own analytics, advertising and personalisation purposes. We have only limited influence over this processing.

The use of the social networks mentioned above may involve the processing of personal data outside the European Union or the European Economic Area.

Information about possible transfers to third countries, their legal bases and the data protection safeguards used by the respective platform operators can be found in the privacy information provided by the respective providers and linked above.

Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on this website.

Google Analytics enables us to analyse the use of our website. In this context, information about pages viewed, time spent on the website, devices and browsers used, approximate geographical location, and interactions with our website may be processed.

Google Analytics is activated on our website only after you have given your prior consent through our consent management system, Borlabs Cookie. Before you give your consent, the storage of analytics-related data for Google Analytics is disabled.

The legal basis for the processing of personal data is your consent pursuant to Art. 6(1)(a) GDPR. Where information is stored on or accessed from your terminal device, this is also based on your consent pursuant to Section 25(1) TDDDG.

We use Google Consent Mode. This involves transmitting the choice you make in our consent management system to Google and adjusting the behaviour of Google tags accordingly. Our website uses the simple or “Basic” version of Consent Mode. Google Analytics is therefore activated only after the corresponding consent has been given.

Data processed in connection with this service may also be processed outside the European Union or the European Economic Area, particularly in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework. Where a data transfer is not based on an adequacy decision, Google states that it uses, in particular, standard contractual clauses approved by the European Commission as appropriate safeguards.

Further information about the frameworks used by Google for international data transfers is available at:
https://policies.google.com/privacy/frameworks

You may withdraw or change your consent at any time with effect for the future through the privacy settings on our website.

Further information about data protection at Google can be found in Google’s privacy information.

Further information about the processing of personal data by Google is available at:
https://policies.google.com/privacy

Information about how Google uses data from websites and apps that use Google services is available at:
https://policies.google.com/technologies/partner-sites

Google Maps

Maps provided by Google Maps may be embedded on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Maps allows us to display locations and geographical information and, for example, helps you plan your journey to us.

To protect your data, embedded Google Maps content is blocked through our consent management system, Borlabs Cookie, until you have consented to the use of the corresponding external media service. Before you give your consent, the Google Maps map is not loaded and no connection to Google’s servers is established through the embedded content.

Google Maps is loaded only after you have given your consent. In this context, your IP address, information about the browser and terminal device used, the page accessed, and other technical information may be transmitted to Google and processed there. Cookies or comparable technologies may also be used to store information on your terminal device or access information stored on it.

If you are logged into your Google account while using Google Maps, Google may associate the information collected in connection with your use of Google Maps with your Google account. We have only limited influence over Google’s subsequent processing of this data.

Further information about the frameworks used by Google for international data transfers is available at:

https://policies.google.com/privacy/frameworks

You may withdraw or change your consent at any time with effect for the future through the privacy settings on our website.

Further information about the processing of personal data by Google is available at:

https://policies.google.com/privacy

Information about how Google uses data from websites and apps that use Google services is available at:

https://policies.google.com/technologies/partner-sites

Information about Google Maps is available at:

https://www.google.com/intl/de/help/terms_maps/

Google reCAPTCHA

We may use Google reCAPTCHA on our website to verify entries in forms and protect the website against automated access, spam and misuse. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

When Google reCAPTCHA is used, your IP address, information about the browser and terminal device used, technical information about access to our website, and other information necessary to identify automated access may be transmitted to Google and processed there.

The use of Google reCAPTCHA on our website is controlled through our consent management system, Borlabs Cookie. Where consent is required for the use of Google reCAPTCHA, the service is activated only after you have given the corresponding consent.

The legal basis for consent-based processing of personal data is Art. 6(1)(a) GDPR. Where information is stored on or accessed from your terminal device and consent is required for this, processing is based on Section 25(1) TDDDG.

The purpose of processing is to protect our website and forms against automated submissions, spam and other forms of misuse.

Further information about the frameworks used by Google for international data transfers is available at:
https://policies.google.com/privacy/frameworks

You may withdraw or change your consent at any time with effect for the future through the privacy settings on our website.

Further information about the processing of personal data by Google is available at:

https://policies.google.com/privacy

Google’s Terms of Service are available at:

https://policies.google.com/terms

Google Ads and Conversion Tracking

We use Google Ads, an online advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on this website.

Google Ads allows us to advertise our offerings in Google search results and on websites and services within the Google advertising network. In addition, conversion tracking allows us to determine whether users perform certain actions on our website after clicking on one of our advertisements. This enables us to measure and optimise the effectiveness of our advertising activities.

In this context, information about pages viewed, interactions with our website, the browser and terminal device used, and previously clicked advertisements may be processed. Cookies or comparable technologies may be used for this purpose.

Google Ads is activated on our website only after you have given your prior consent through our consent management system, Borlabs Cookie.

We use Google Consent Mode. The choice you make in our consent management system is transmitted to Google and the behaviour of Google tags is adjusted accordingly. Our website uses the simple or “Basic” version of Consent Mode. The corresponding Google Ads functions are therefore activated only after you have given your consent.

Further information about the frameworks used by Google for international data transfers is available at:
https://policies.google.com/privacy/frameworks

You may withdraw or change your consent at any time with effect for the future through the privacy settings on our website.

Further information about the processing of personal data by Google is available at:

https://policies.google.com/privacy

Information about how Google uses data from websites and apps that use Google services is available at:

https://policies.google.com/technologies/partner-sites

Information about the privacy and advertising settings of your Google account is available at:

https://myadcenter.google.com/

Google Ads Remarketing

We use remarketing functions as part of Google Ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Remarketing allows us to assign users of our website to specific target groups and potentially display interest-based advertising to them on Google services and on websites and services within the Google advertising network, based on their previous use of our website.

In this context, information about pages visited, interactions with our website, the browser and terminal device used, and other technical information may be processed. Cookies or comparable technologies may be used for this purpose.

Google Ads Remarketing is activated on our website only after you have given your prior consent through our consent management system, Borlabs Cookie.

We use Google Consent Mode. Our website uses the simple or “Basic” version. Google services required for advertising purposes are therefore activated only after the corresponding consent has been given.

If you have a Google account and Google has enabled the corresponding personalisation functions, Google may associate the information collected with your Google account and use it for personalised advertising. We have only limited influence over this processing by Google.

Further information about the frameworks used by Google for international data transfers is available at:
https://policies.google.com/privacy/frameworks

You may withdraw or change your consent at any time with effect for the future through the privacy settings on our website.

Further information about the processing of personal data by Google is available at:
https://policies.google.com/privacy

Information about how Google uses data from websites and apps that use Google services is available at:
https://policies.google.com/technologies/partner-sites

You can manage your settings for personalised advertising on Google through Google My Ad Center, among other options:
https://myadcenter.google.com/

YouTube Videos

Videos from the YouTube platform may be embedded on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). YouTube is operated by Google.

To protect your data, embedded YouTube content is blocked through our consent management system, Borlabs Cookie, until you have consented to the use of the corresponding external media service. Before you give your consent, the embedded YouTube video is not loaded and no connection to YouTube’s servers is established through the embedded content.

The YouTube content is loaded only after you have given your consent. In this context, your IP address, information about your browser and terminal device, the page accessed, and information about your interaction with the embedded content may be transmitted to Google or YouTube. Cookies or comparable technologies may also be used to store information on your terminal device or access information stored on it.

If you are logged into your Google or YouTube account at the same time, Google may associate the information collected when accessing or using the video with your user account.

Further information about the frameworks used by Google for international data transfers is available at:
https://policies.google.com/privacy/frameworks

You may withdraw or change your consent at any time with effect for the future through the privacy settings on our website.

Further information about the processing of personal data by Google and YouTube is available at:

https://policies.google.com/privacy

Further information about YouTube is available at:

https://www.youtube.com/howyoutubeworks/user-settings/privacy/

Web Chat and Chatbot (Tidio)

We use the Tidio web chat and chatbot service on our website. The providers are companies within the Tidio Group, particularly Tidio Ltd., 220C Blythe Road, London W14 0HH, United Kingdom, and Tidio Poland Sp. z o.o., Wojska Polskiego 81, 70-481 Szczecin, Poland.

Tidio allows us to communicate with visitors to our website through a chat function and handle enquiries. When you use the chat, the content and contact details you enter, as well as technical information about your browser, terminal device and use of the chat, may be processed.

The use of Tidio on our website is controlled through our consent management system, Borlabs Cookie, and is activated only after you have given your prior consent. Before you give your consent, the external resources required for the Tidio chat are not loaded.

During use, Tidio or the technologies employed may store information on your terminal device or access information stored on it.

The legal basis for activation and the associated processing of personal data is your consent pursuant to Art. 6(1)(a) GDPR. Where information is stored on or accessed from your terminal device, this is also based on your consent pursuant to Section 25(1) TDDDG.

If you submit a specific enquiry to us through the chat, the further processing of the information you voluntarily provide may additionally be carried out for the purpose of handling your enquiry or taking steps prior to entering into a contract pursuant to Art. 6(1)(b) GDPR.

Depending on the processing activity, data may also be processed outside the European Union or the European Economic Area. Tidio provides information about the data protection safeguards used for this purpose in its privacy information.

You may withdraw or change your consent at any time with effect for the future through the privacy settings on our website.

Further information about the processing of personal data by Tidio is available at:

https://www.tidio.com/privacy-policy/

Local Web Fonts and MyFonts/Monotype Web Font Tracking

We use the “Gilroy” font on our website. The web font files required to display this font are hosted locally on our own web server. Therefore, no connection to external font servers is established when the actual font files are retrieved.

In connection with the licensing of the web fonts used, web font tracking by MyFonts or Monotype is additionally integrated into our website. The provider is Monotype Imaging Holdings Inc. or an affiliated Monotype company.

When our website is accessed, a connection to hello.myfonts.net is established for this purpose. This connection is used to record font usage or page views in connection with web font licensing and not to deliver the actual font files.

According to Monotype, the data processed as part of this web font tracking may include an anonymised web font project ID, the licensed website or its URL, the referrer URL, and the IP address required to establish the technical connection. Monotype states that the IP address is transmitted to an external service provider to count page views and prevent unauthorised use of the fonts. According to Monotype, the IP address is not transmitted to Monotype and is neither stored nor otherwise processed by the service provider used. To determine the monthly number of page views, Monotype states that it stores the anonymised web font project ID together with the corresponding log data for 30 days in encrypted log files. According to Monotype, these log files are deleted after the monthly page views have been determined and recorded.

According to Monotype, no cookies are used in connection with this web font usage tracking.

Processing is carried out to record web font usage and to ensure and monitor compliance with the relevant licensing terms. According to Monotype, web font tracking is based on legitimate interests pursuant to Art. 6(1)(f) GDPR.

Further information about web font tracking and the processing of personal data by Monotype is available at:

https://www.monotype.com/de/rechtshinweise/datenschutzrichtlinie/datenschutzrichtlinie-zum-tracking-von-webschriften

Further information about data protection at Monotype is available at:

https://www.monotype.com/de/rechtshinweise/datenschutzrichtlinie

Online Shop

We operate a separate online shop at https://openshop.boxlab-services.com/. You can access our online shop through the corresponding links on this website.

When you access the online shop, you technically leave the corporate website boxlab-services.com and switch to the separately operated shop website openshop.boxlab-services.com.

In the online shop, personal data are processed particularly in connection with the use of the shop, the creation and use of customer accounts, the processing of orders, payment processing, and communication relating to orders.

The privacy information provided in the online shop applies to its use. This information includes further details about the technical services, cookies and comparable technologies, payment services, and analytics and marketing services used in the shop.

The Privacy Policy for our online shop is available at:

https://openshop.boxlab-services.com/datenschutz

Privacy of Minors

This website is intended for use by persons aged 18 or older. We do not intentionally attempt to collect information about persons under the age of 18.

Persons under the age of 18 should not submit information to or publish information on our websites. If such a person submits personal data through our websites, we will delete this information as soon as we become aware of their age and will not use it for any further purposes.

Automated Decision-Making

Personal data collected through this website are not subject to automated individual decision-making.

Data Transfers to Third Countries

The use of individual services described in this Privacy Policy may involve the transfer or other processing of personal data outside the European Union or the European Economic Area.

Such data transfers are carried out only in compliance with the statutory requirements of Articles 44 et seq. GDPR.

Where the European Commission has issued an adequacy decision for the respective third country pursuant to Art. 45 GDPR, the transfer may be based on that decision. This applies in particular to transfers to appropriately certified companies in the United States under the EU-U.S. Data Privacy Framework.

Where no applicable adequacy decision exists, standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR or other appropriate safeguards may be used as the basis for the data transfer.

Further information about possible transfers to third countries and the data protection safeguards used in each case can be found in the descriptions of the services used and in the privacy information provided by the respective providers.

Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection regulations.

In particular, you may contact the supervisory authority responsible for us:

The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Postfach 30 40
55020 Mainz
Germany
https://www.datenschutz.rlp.de/

As of September 2026