Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data on this website, in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), is:

Liora Bioinformatics UG (haftungsbeschränkt)
Armlederstrasse 17
78628 Rottweil
Germany

Represented by Managing Director: Marian Freisleben
Register Court: Amtsgericht Stuttgart
Register Number: HRB 807677
Email: marian.freisleben@liora-bioinformatics.com

We are not required to appoint a data protection officer under Art. 37 GDPR or § 38 BDSG. Please direct any data protection enquiries to the contact details given above.

2. Scope of this Privacy Policy

This Privacy Policy informs you about the nature, scope, and purpose of the processing of personal data on our website and in connection with our services. Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject”).

We are committed to protecting your privacy and handling your personal data responsibly and in compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Data We Collect and Process

We collect and process personal data only to the extent necessary and for the purposes for which it was collected.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

a) Server Log Data

When you visit our website, our hosting provider automatically collects and stores information in so-called server log files that your browser automatically transmits to us. This data includes:

• IP address
• Date and time of the server request
• Browser type and version
• Operating system used
• Referrer URL (the previously visited page)
• Host name of the accessing computer
• HTTP status code

Purpose of Processing: This data is processed for essential technical and security purposes, such as maintaining the stability, security, and performance of our website, and for detecting and preventing technical issues or malicious attacks.

Legal Basis: The processing of server log data is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the functional operation and security of our website.

Retention Period: Server log data is retained for a period strictly necessary to fulfill these operational and security purposes, typically up to 6 months, or as required by the policies of our hosting provider and applicable legal obligations. In exceptional cases, longer retention may occur for purposes of evidence, such as in the event of a security incident or suspected misuse.

b) Contact Form Data

If you use our contact form to get in touch with us, we will collect the personal data you provide in the input mask. This typically includes:

• Your Name
• Your Email Address
• The Subject of your inquiry
• The content of your Message
• Your institute or company, if you choose to provide it

When the form is submitted, your IP address, your browser’s user agent string, and the time of submission are also transmitted to our form-delivery processor, which uses them to deliver the message and to filter spam (see section 4).

Provision of Data: You are under no statutory or contractual obligation to provide this data. Without your name, email address, topic, and message, however, we cannot respond to your enquiry. The institute or company field is optional.

Purpose of Processing: The personal data you provide via the contact form is processed solely for the purpose of responding to your inquiry and for facilitating initial communication for potential business relationships (pre-contractual steps).

Legal Basis: The processing of your contact form data is based on steps taken at your request prior to entering into a contract pursuant to Art. 6(1)(b) GDPR, as your inquiry may lead to a potential business relationship. For general inquiries not directly leading to a contract, the legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR, which is to communicate with interested parties and respond to queries.

Retention Period:

• If your inquiry does not lead to a contractual relationship: Your data will be retained for as long as necessary to fully address your request and for a reasonable follow-up period, typically no longer than 12 months after the last communication.
• If your inquiry leads to a contractual relationship: Your data will be integrated into our client records. The retention of this data will then be governed by the retention periods applicable to client contractual documents, which can extend up to 10 years due to commercial and tax law obligations in Germany (e.g., § 257 HGB, § 147 AO). In cases where legal disputes or official investigations are pending, data may be retained for the duration of such proceedings plus any applicable statutory limitation periods.

c) Contact by Email

If you contact us by email, we process your email address, the content of your message, and any further details you provide (such as your name, organisation, or attachments), together with the metadata of the email (time of sending and technical header information). Messages sent through our contact form also reach us in this way. Our email accounts are provided by Google (see section 4).

Purpose, Legal Basis, and Retention: The purposes, legal bases (Art. 6(1)(b) or (f) GDPR), and retention periods described above for contact form data apply equally to enquiries by email.

d) Cookies and Local Storage

We do not use cookies, and we do not use any analytics, tracking, profiling, or advertising technologies on this website. We store no information on your device for those purposes.

Our website stores exactly one entry in your browser’s local storage, which is purely functional:

• liora-lang — records whether you selected English or German using the language switch, so that your choice is retained on subsequent pages and visits. It contains nothing but the value en or de. The entry is created only when you click the language switch; until then, the page language follows your browser’s language setting and nothing is stored.

Legal Basis: This entry is strictly necessary to provide a service you have expressly requested, and is therefore exempt from the consent requirement under § 25(2) no. 2 TDDDG. Because we set no cookies or storage requiring consent, this website does not display a consent banner.

You can delete this locally stored information at any time through your browser’s settings. Doing so has no effect other than resetting your language preference.

4. Disclosure of Data to Third Parties

We will only transfer your personal data to third parties if this is necessary for the purposes mentioned above, if there is another legal basis for such transfer, or if you have given your explicit consent.

• Hosting Provider: This website is hosted on GitHub Pages, operated by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. GitHub processes the server log data described above when delivering our pages. GitHub, Inc. is certified under the EU–US Data Privacy Framework.
• Form Processing: Contact form submissions are processed on our behalf by Teijal, Inc. d/b/a Formcarry, 3 Germay Dr, Unit 4 #1278, Wilmington, DE 19804, USA, solely to deliver your message to us by email. This covers the form contents and the technical data described in section 3(b) (IP address, user agent, time of submission). Formcarry’s application and database are hosted in Frankfurt am Main, Germany. Formcarry also engages sub-processors in the USA, in particular Amazon Web Services, Inc. for email and file storage and Automattic, Inc. (Akismet) for spam filtering, to which the submitted data may be transmitted for these purposes. A data processing agreement pursuant to Art. 28 GDPR, including the European Commission’s Standard Contractual Clauses, forms part of Formcarry’s terms of service.
• Spam Protection: Our contact form is protected against automated abuse by a hidden form field evaluated in your browser and by the spam filtering of our form-delivery processor. We do not use Google reCAPTCHA or any comparable third-party captcha service, and no data is transmitted to Google for this purpose.
• Download statistics: The download figures shown on our software package pages originate from the public cranlogs service (cranlogs.r-pkg.org). We retrieve them in advance and serve them from our own web space, so your browser does not contact that service and no data about you is transmitted to it.
• Software version information: The current release number shown on our PhyloTrace page is retrieved from GitHub in advance and served from our own web space, so your browser does not contact the GitHub API and no data about you is transmitted to it.
• Fonts and other assets: All fonts, stylesheets, scripts, and images used on this website are delivered from our own web space. We do not embed Google Fonts or any comparable external font, script, or content delivery service, so no data is transmitted to such providers when you visit our pages.
• Email hosting: Our email accounts are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as part of Google Workspace. Google processes the emails we send and receive, including messages forwarded from our contact form, on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR (Google Cloud Data Processing Addendum). Processing on servers of Google LLC in the USA cannot be ruled out.

5. International Data Transfers

Some of the providers named above are companies based in the United States, so your personal data (in particular your IP address and server log data) may be transferred there. For such transfers to a third country outside the European Union or European Economic Area, we ensure that appropriate safeguards are in place in accordance with Art. 44 et seq. GDPR.

For GitHub, Inc., Google LLC, and Amazon Web Services, Inc. we rely on the adequacy decision adopted by the European Commission on 10 July 2023 for the EU–US Data Privacy Framework, under which certified US companies are deemed to offer an adequate level of protection. Where a recipient is not certified under that framework, or in addition to it, transfers are based on the Standard Contractual Clauses approved by the European Commission. This applies in particular to Formcarry and its spam-filtering sub-processor Automattic (Akismet), whose data processing agreement incorporates those clauses.

6. Your Data Protection Rights under GDPR

As a data subject under the GDPR, you have comprehensive rights regarding your personal data. We are committed to facilitating the exercise of these rights. Please note that these rights are not absolute and may be subject to certain conditions or exceptions as set forth in the GDPR. You have the right to:

• Right to Information (Art. 15 GDPR): to obtain confirmation as to whether personal data concerning you is being processed, and access to that data and specific information about its processing.
• Right to Rectification (Art. 16 GDPR): to obtain the rectification of inaccurate personal data and to have incomplete data completed.
• Right to Erasure (Art. 17 GDPR): to obtain the erasure of personal data where one of the grounds specified in the GDPR applies.
• Right to Restriction of Processing (Art. 18 GDPR): to obtain restriction of processing where one of the specific conditions in the GDPR applies.
• Right to Data Portability (Art. 20 GDPR): to receive the personal data you provided in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21 GDPR): to object, on grounds relating to your particular situation, to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3) GDPR): to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint (Art. 77 GDPR): to lodge a complaint with a supervisory authority.

Separate notice regarding your right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR — namely the server log data and general enquiries described above — you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing serves to establish, exercise, or defend legal claims. An objection requires no particular form; an email to the address given in section 1 is sufficient.

The competent supervisory authority for Liora Bioinformatics is:

Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart
Germany
Phone: +49 711/61 55 41 – 0
Email: poststelle@lfdi.bwl.de

7. Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. However, please be aware that data transmission over the internet (e.g., communication by email) can have security vulnerabilities. A complete protection of data against third-party access is not possible.

8. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or new technologies. The updated Privacy Policy will be published on our website. We recommend that you review this Privacy Policy periodically.