Privacy Policy

This Privacy Policy explains how Labsun GmbH ("we") processes personal data when you use our website, online shop, or forms.

1. Data Controller

Labsun GmbH
Am Sandfeld 13a, 76149 Karlsruhe, Germany
Tel: +49 721 47080525
Email: info@lab-sun.de
Authorized representative: Shurong Sun (Managing Director)

2. Hosting & CMS

Our website runs on European servers (WordPress + WooCommerce). Data processing agreements in accordance with Art. 28 GDPR are in place with all hosting and maintenance service providers.

Legal basis: Art. 6(1)(f) GDPR (secure and efficient provision).

3. Server Log Files

When accessing the pages, technically necessary data (truncated IP address, date, referrer, browser) is stored for security and error analysis.

Retention period: 14 days, then deleted.

Legal basis: Art. 6(1)(f) GDPR.

4. Cookies & Consent Management

We use cookies and similar technologies.

  • Essential: Shopping cart, checkout, login.
  • Statistics / Marketing: (e.g., Google Analytics 4, Maps) only with consent.

You can change or withdraw your selection at any time via the "Cookie Settings" link in the footer of this website. There you will also find an overview of all cookies and services used.

Legal bases:

  • Essential → Art. 6(1)(f) GDPR + § 25(2) TTDSG
  • Statistics/Marketing → Art. 6(1)(a) GDPR + § 25(1) TTDSG

5. Online Shop and Order Processing

5.1 Contract Fulfillment

To process your order, we process name, company, billing and delivery address, email, telephone, order and payment data.

Purpose: Contract fulfillment, invoicing, customer service, legal obligations.

Legal basis: Art. 6(1)(b) and (c) GDPR.

Retention: 6–10 years according to HGB/AO.

5.2 Payment Methods

You can choose between PayPal , credit card and purchase on invoice .

  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Data transfer to the USA where applicable (EU–US Data Privacy Framework, SCCs).
  • Credit card: Processing via the respective payment service provider (e.g., Stripe).
  • Purchase on invoice: Processing exclusively internal.

Legal basis: Art. 6(1)(b) GDPR.

5.3 Shipping Service Providers

For delivery purposes, we transmit address and contact data to DHL, UPS, DPD, or a contracted freight forwarder.

Legal basis: Art. 6(1)(b) GDPR.

If the respective shipping service provider offers delivery or parcel notification via email or SMS, this is done exclusively with your express consent (Art. 6(1)(a) GDPR).

6. Contact Forms & Communication

For inquiries via forms, email, or telephone, we process your information to handle the request.

Legal basis: Art. 6(1)(b) / (f) GDPR.

7. Newsletter (Email Marketing)

We offer you the option to subscribe to our newsletter to receive regular information about our products, services, and promotions.

For registration, we use the double opt-in procedure . Your registration will only be activated after you confirm your email address.

Data processed: Email address, name (optional), registration time, IP address.

Legal basis: Art. 6(1)(a) GDPR (consent); Art. 6(1)(f) GDPR (proof of consent).

The data is used exclusively for sending the newsletter and is not shared with third parties.

If a mailing service provider (e.g., Sendinblue, Mailchimp, Brevo, or CleverReach) is used in the future, processing will be based on a data processing agreement in accordance with Art. 28 GDPR. In this case, we will provide information here about the specific provider (full company name, address, country) and—if necessary—about international data transfers based on the EU–US Data Privacy Framework or Standard Contractual Clauses pursuant to Art. 46 GDPR.

You can unsubscribe from the newsletter at any time via the unsubscribe link in each email or by sending a message to info@lab-sun.de .

8. Applications (Online Application Form or Email)

When you apply with us, we process your personal data (name, contact details, application documents) exclusively for the purpose of processing your application.

Legal basis: Art. 6(1)(b) GDPR in conjunction with § 26 BDSG.

Data is made accessible internally only to authorized personnel and deleted 6 months after completion of the process, unless longer retention (talent pool) has been agreed.

9. CRM & Sales Communication

For efficient support of our customers and prospects, we use a Customer Relationship Management system (CRM) . The system is used to manage contact and communication data, track inquiries and offers, and coordinate sales activities.

Data processed: Name, company, function, contact details, communication content, offer and order data.

Legal bases:

  • Art. 6(1)(b) GDPR (pre-contractual/contractual communication)
  • Art. 6(1)(f) GDPR (legitimate interest in efficient business organization)
  • With consent to marketing automation or tracking: Art. 6(1)(a) GDPR

If an external CRM provider (e.g., HubSpot, Zoho, or Odoo) is used in the future, this will be based on a data processing agreement and, where applicable, appropriate safeguards (e.g., EU–US Data Privacy Framework, Standard Contractual Clauses). We will provide information at this point about the specific provider (full company name, location, country) and any additional marketing or tracking functions used after implementation of the system.

10. Google Analytics 4 (Only with Consent)

We use Google Analytics 4 (GA4) for anonymized usage analysis, provided you consent in the cookie banner. IP addresses are truncated.

Provider: Google Ireland Limited, Dublin.

Legal basis: Art. 6(1)(a) GDPR.

Retention period: 14 months.

Data transfer to the USA in accordance with EU–US Data Privacy Framework or Standard Contractual Clauses (SCCs).

11. Google Maps (Only with Consent)

Embedded for location display. Data is only transferred after consent.