VelaLabs

Privacy Policy

Version: 2026-06-11

1. Data Protection Overview

This Privacy Policy informs you in accordance with Art. 13 and 14 of the EU General Data Protection Regulation (GDPR) about the nature, scope, and purpose of the processing of personal data within our order portal.

2. Data Controller

VelaLabs GmbH
Brunnerstraße 69/3
1230 Wien, Austria
Phone: +43 1 890 5979-10
E-Mail: office@vela-labs.at

Data Protection Officer: Gunther Kohn
E-Mail: dataprivacy@tentamus.com

3. What data is processed, for what purpose, and on what legal basis?

a) Account registration

Data: Name, email, password hash, optional phone number

Purpose: Provision of a personal account for the order portal.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / pre-contract steps)

Retention: Stored as long as the account is active + 30 days after account deletion (soft delete); physical deletion thereafter.

b) Order / Sample data

Data: Company, contact person, address, phone, email, sample details, testing parameters, attachments (e.g. test methods, safety data sheets), cost center, quotation number

Purpose: Performance of the commissioned laboratory testing and contractual communication (order confirmation, status, end report, invoicing).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for GxP documentation additionally Art. 6(1)(c) GDPR (legal obligation).

Retention: At least 10 years in accordance with GMP / pharmaceutical law / GxP documentation requirements. Personal fields are anonymized thereafter; technical measurement and testing data may be retained longer where retention obligations require it.

c) Consent log

Data: Timestamp of consent, document version, hashed IP value (SHA-256, non-reversible), user agent

Purpose: Proof of consent in accordance with Art. 7 GDPR.

Legal basis: Art. 6(1)(c) GDPR (legal obligation to demonstrate consent).

Retention: As long as the underlying contractual relationship exists + 3 years after its termination (standard limitation period).

d) Audit / security logs

Data: Action (e.g. login, status change, file download), actor (user ID), time, hashed IP value, user agent

Purpose: IT security, abuse detection, evidence of data access (Art. 32 GDPR).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and integrity).

Retention: 12 months, automatically deleted thereafter.

e) Server log files

Data: Anonymized IP address, date/time, requested URL, referrer, browser/OS

Purpose: Provision of the website, detection of technical errors, defence against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable operation).

Retention: Managed by the hosting provider and typically rotated after a maximum of 30 days.

f) Email dispatch

Data: Email address, content of transactional email (e.g. order confirmation, status change, password reset)

Purpose: Contract-related communication. No marketing emails are sent.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Retention: Send logs are kept for 30 days; the email content is handled per the order record's retention schedule.

4. Cookies and LocalStorage

We use only strictly necessary cookies and LocalStorage entries:

  • Authentication cookies from Supabase (session, refresh token) — lifetime max. 7 days, deleted immediately on sign-out.
  • Language preference (LocalStorage „tv.lang“) and cookie-notice acknowledgement („tv.cookies.ack“).

No tracking, analytics, advertising, or third-party cookies are set. No consent is therefore required under §25(2) TTDSG / ePrivacy Directive.

5. Data processors and recipients

We use carefully selected service providers with whom data-processing agreements pursuant to Art. 28 GDPR exist. Processing generally takes place within the EU/EEA:

  • Supabase (Datenbank, Authentifizierung, Datei-Speicher): Hosting in eu-central-1 (Frankfurt am Main). Provider: Supabase Inc., 970 Toa Payoh North, #07-04, Singapore — data is stored in the EU data center.
    For more information, see Supabase's privacy policy: https://supabase.com/privacy
  • Vercel (Webhosting / Edge-Runtime): Delivery via Frankfurt region (fra1). Provider: Vercel Inc., USA. Transfers to the USA are safeguarded by Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework.
    For more information, see Vercel's privacy policy: https://vercel.com/legal/privacy-notice
  • Microsoft 365 (SMTP-Mailversand): Dispatch of transactional emails via the Tentamus Microsoft 365 mailbox. Microsoft Ireland Operations Ltd., Dublin; partial processing in the USA, safeguarded by SCC and Data Privacy Framework.
    For more information, see Microsoft's privacy statement: https://www.microsoft.com/de-de/privacy/privacystatement

We do not share data with other third parties unless required for performance of the contract or by law.

6. Transfers to third countries

The core data set remains in the EU. Where data processors (e.g. Vercel, Microsoft) may process data in the USA, transfers are based on the EU Standard Contractual Clauses (2021) and the recipient's self-certification under the EU-US Data Privacy Framework pursuant to the European Commission's adequacy decision of 10 July 2023.

7. Your rights

You have the following rights vis-à-vis us at any time:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Erasure / right to be forgotten (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of granted consent (Art. 7(3) GDPR)

Access, erasure, and data-export requests can be made directly in the dashboard under “My Account → Data & Privacy” or by emailing our data protection officer.

8. Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Competent supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, Österreich — www.dsb.gv.at

9. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place. Order processing and status changes are carried out exclusively by our staff.

10. Data security

We employ technical and organizational measures pursuant to Art. 32 GDPR: TLS transport encryption, row-level security in the database, salted-hashed IP values in the audit log, short-lived signed download URLs, rate-limiting, magic-byte validation on file uploads, optional two-factor authentication, and full auditing of administrative actions.

SSL encryption

For security reasons and to protect the transmission of confidential content, such as the requests you send to us as the site operator, this site uses SSL encryption. You can recognize an encrypted connection by the browser's address line changing from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL encryption is activated, the data you transmit to us cannot be read by third parties.

11. Changes to this Privacy Policy

We reserve the right to amend this Policy, e.g. when laws or our processing activities change. The current version is always available here and is shown together with the date of the most recent update in the top right.