Privacy Policy

1. Controller

2. General Information

We process personal data only to the extent necessary for providing a functional website, communicating with users, or conducting our research and information services. Processing is carried out on the basis of the General Data Protection Regulation (GDPR).

• Consent (Art. 6(1)(a) GDPR)
• Contract or pre-contractual measures (Art. 6(1)(b) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)

Personal data is deleted once the purpose of processing no longer applies or statutory retention periods have expired.

3. Server Log Files

When you visit our website, the hosting provider automatically collects and temporarily stores information in server log files, including:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

This data is processed for the technical provision of the website, system security, and optimization of our online services.

Legal basis: Art. 6(1)(f) GDPR

Retention period: 14 days

4. Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar technologies to collect and analyze information about your use of the website. The following data is collected:

• Client ID: A pseudonymous identifier stored in the _ga cookie (duration: 2 years)
• Session ID: Stored in the _ga_<ID> cookie (duration: 2 years; session inactivity timeout: 30 minutes)
• IP address: Transmitted to Google; truncated within the EU/EEA before transfer to US servers
• Usage data: Pages visited, time of visit, duration, referrer URL, click behavior, scroll depth
• Device information: Browser type/version, operating system, screen resolution, language settings
• Geographic data: Approximate location derived from IP address (country, region, city)

We use Google Analytics to analyze how visitors use our website in order to improve our content and user experience.

Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. Google Analytics cookies are only set after you have given your explicit consent via our cookie consent banner.

Data recipient: Google Ireland Limited. Google Ireland Ltd. may transfer data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google acts as our data processor under a Data Processing Agreement pursuant to Art. 28 GDPR; Google Signals and Ads Data Sharing are disabled in our GA4 configuration. The transfer to the USA is safeguarded as described in Section 6 (International Data Transfers).

Retention: Event data is retained by Google for 14 months and then automatically deleted.

You can withdraw your consent at any time by adjusting your cookie settings via the "Cookie Settings" link in the footer. You can also delete existing cookies through your browser settings or use the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

For more information on how Google processes data, see: https://policies.google.com/privacy

5. Cookies

Cookies are small text files stored on your device when you visit our website. We distinguish between strictly necessary cookies (which do not require consent) and analytics cookies (which require your explicit consent). Analytics cookies set by Google Analytics (_ga, _ga_<ID>) are described in detail in Section 4 above.

Cookies used on this website:

Strictly Necessary Cookies

Legal basis for the aram_consent cookie: § 25(2) No. 2 TDDDG (storage is strictly necessary to provide the website service expressly requested by the user).

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA).

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This transfer is safeguarded by Google LLC's certification under the EU-US Data Privacy Framework (adequacy decision by the European Commission, July 10, 2023), Standard Contractual Clauses (SCCs), and Google's Data Processing Amendment.

We ensure that any transfer of personal data to a third country is subject to appropriate safeguards as required by Chapter V of the GDPR.

7. Contact

When you contact us via contact form or email, we process the personal data you provide (in particular name and email address) solely for the purpose of handling your inquiry.

Legal basis: Art. 6(1)(a) GDPR

8. Hosting and Data Processing

Our website is hosted by an external service provider. We have entered into a data processing agreement with our hosting provider in accordance with Art. 28 GDPR.

9. Newsletter

If you subscribe to our newsletter, we process your email address solely for the purpose of sending information. You can unsubscribe at any time via the unsubscribe link in the newsletter.

Legal basis: Art. 6(1)(a) GDPR (consent)

10. Research Projects

As a research lab, we process personal data in the context of scientific research projects, including interviews, surveys, and qualitative/quantitative research. Participation is voluntary. Personal data is anonymized or pseudonymized where possible.

Legal basis: Art. 6(1)(a) GDPR, Art. 89 GDPR

Retention: As long as research data is needed for scientific purposes.

11. Your Rights

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

12. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Aram Lab is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit

13. Data Security

We employ appropriate technical and organizational measures to protect your personal data against loss, manipulation, and unauthorized access. Data transmission is encrypted using SSL/TLS.

14. Changes to This Policy

This Privacy Policy is current as of May 2026 and may be updated when legal or technical changes occur. The current version is always available on our website.

If you have any questions or concerns about this policy, please contact us at: info@aramlab.info