Privacy Notice
Data Protection at a Glance
This privacy policy provides information on the processing of personal data in connection with the website lilianlabs.com, enquiries made via email, telephone or the contact form, as well as the LILIAN app and the LILIAN Manager, insofar as Lilian Labs GmbH is the data controller in these matters. Where a distributor, customer or other contractual partner processes personal data as a data controller in their own right, their own privacy policy shall apply. Overarching guidelines are set out in the ‘Lilian Labs GmbH Data Protection Policy’; mandatory data protection law takes precedence.
The following statement provides an overview of what data is collected and how your personal data is handled. We also inform you of your rights and provide details of the relevant contact persons.
Personal data is any data that can be used to identify you personally, e.g. name, address, email address, IP address, and data relating to usage behaviour.
Who is responsible for data collection on this website?
Data processing on our website lilianlabs.com and via the “LILIAN Manager” app is carried out by us, Lilian Labs GmbH, Salzdahlumer Straße 196, 38126 Braunschweig, as the data controller within the meaning of Article 4(7) of the EU GDPR (hereinafter “us” or “we”). You can find our further contact details in the legal notice on our website.
What data do we collect?
Contact form
If you send us enquiries via the contact form, we will process the information you provide in the enquiry form, including the contact details you provide there, in order to deal with your enquiry and in the event of any follow-up questions. The legal basis is Article 6(1)(b) of the GDPR, insofar as your enquiry relates to the initiation or performance of a contract; otherwise, we process the data on the basis of Article 6(1)(f) of the GDPR in our legitimate interest in the proper handling of enquiries. We do not disclose this data without a legal basis or your consent.
Customer and contract data
The following data is collected for the purpose of managing our contractual relationship, for the analysis of measurement data when using the online service, and when using our LILIAN Manager app, provided you have entered this data in full. The processing serves to initiate, execute and fulfil the contract, as well as to provide the agreed services, and is carried out on the basis of Article 6(1)(b) of the GDPR:
- Surname
- Company
- Email address
- Telephone number
Once you have logged in, your data will be linked to the measurement data assigned to you and a date/time stamp. If you have added any personal comments regarding the measurement, these will also be stored.
Use of the LILIAN app or our software solutions (‘SaaS’)
When using the LILIAN app, depending on the functions used, technical device, network and authorisation data may be processed, as well as data provided by the user via activated device functions, in particular the camera or location services. The specific data processed in each individual case depends on the function actually used. Data is stored or transmitted only to the extent necessary for the respective function, the fulfilment of the contract, security or an expressly described additional service.
When using the LILIAN app and the LILIAN Manager, in addition to account and contact details, measurement data, timestamps, settings, measurement locations, measurement positions, comments entered and other measurement and documentation data entered by the user or customer may be processed. Depending on the functions activated, user, role and authorisation data, login and security logs, device and network data, data relating to measurement value corrections and export processes, as well as alarm and notification data may also be processed.
Where notifications are enabled, the email address or mobile phone number required for this purpose may be transmitted to the relevant technical service providers. The specific service providers used and the respective categories of data processed are set out in the current list of service providers or tools.
Where customers or distributors enter data relating to their own customers, employees or other individuals into the SaaS application, Lilian Labs generally processes this data on behalf of the respective customer or distributor in accordance with the separate data processing agreement. The respective customer or distributor remains responsible for the lawfulness of this processing and for informing the data subjects.
Use of online services
When you use our online portal, the provider of the website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:
- browser type and browser version
- operating system used
- Referrer URL
- Host name of the accessing computer – time of the server request
- IP address
How and why do we collect your data?
Processing of your personal data for the purpose of establishing, defining the content of or amending the legal relationship, Article 6(1)(b) of the GDPR
When you enter into a contract and use our online portal, we collect, process and use your data to the extent necessary for the initiation of the contract, the conclusion of the contract or the use of our online services.
The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of the user contract, and Article 6(1)(f) of the GDPR, insofar as it serves the purposes of security, stability, fault analysis, quality assurance or the improvement of software performance. Optional additional functions are processed, where necessary, on the basis of consent pursuant to Article 6(1)(a) of the GDPR.
This also applies to the LILIAN app and associated software services.
Processing of your personal data for informational use on the basis of legitimate interests, Article 6(1)(f) of the GDPR
In the case of purely informational use of our website – that is, if you neither register, log in nor otherwise provide us with additional information – we initially collect and process only the personal data that your browser and your internet service provider transmit to our server. This data is technically necessary to display the website to you and to ensure the stability and security of our service. This is carried out on the basis of our legitimate interest in the secure and functional operation of the website and server in accordance with Article 6(1)(f) of the GDPR.
Specifically, this includes the truncated and therefore anonymised IP address (truncation prevents any association with an individual), the website you last visited (referrer), the websites you have visited within the Lilian Labs GmbH service, the names of the files accessed, the date and time of access, and the operating system and browser version of your computer. We also store the aforementioned data in log files. This storage is carried out to ensure the website functions properly. Furthermore, we use the data to optimise our website and ensure its security. However, the aforementioned data is not stored together with any other personal data. Log files are stored for a maximum of 7 days.
In order to provide the website’s functions and to fulfil our own obligations, we pass on your data to our service providers and, in turn, receive data from them. This also applies if you contact us via the specified channels (emails, forms) or use other services on our website. The legal basis is Article 6(1)(b) of the GDPR, insofar as this is necessary for the initiation or performance of a contract, and otherwise Article 6(1)(f) of the GDPR.
For how long do we store your data, and what criteria are used to determine the duration?
In the case of purely informational use, we store the aforementioned personal data for as long as is necessary for the provision or use of the service. Once the respective purpose has been fulfilled, the data is deleted.
Data stored in log files is deleted after 7 days at the latest. Furthermore, personal data stored in log files is anonymised.
Where statutory or contractual retention periods apply, particularly in the case of a user or contractual relationship, we are obliged to store the data until these periods have expired. Processing to fulfil statutory retention obligations is carried out on the basis of Article 6(1)(c) of the GDPR. Once the relevant obligations have expired or ceased to apply – obligations arising, in particular, from commercial and tax law in cases of statutory retention obligations (see Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB)) – we will delete the relevant data.
For marketing communications, we store your data until you object to its use, withdraw your consent or such communications are no longer permitted by law. We store your other data only for as long as we need it to fulfil the specific purpose (e.g. for the performance or processing of a contract) and delete it once that purpose no longer applies.
Retention periods for measurement data and account data
For measurement and account data, the retention periods specifically set out in the central data protection policy of Lilian Labs GmbH and in the relevant contract apply. The information below describes standard retention periods specific to the purpose and does not constitute a blanket guarantee of a particular retention period.
Storage of data from active accounts
We generally store measurement data and account data from active user accounts for the duration of the existing contractual relationship and, beyond that, for a period of up to ten (10) years, insofar as this is necessary to fulfil contractual obligations, including any warranty and liability claims, to comply with statutory retention obligations, to ensure the functionality and security of our systems, and for quality assurance and the long-term comparability of measurement results within the scope of the agreed services. This period is a standard retention period specific to the purpose and does not constitute a blanket guarantee of storage. Processing is carried out on the basis of Article 6(1)(b), (c) and (f) of the GDPR in accordance with the respective purposes stated.
- to fulfil contractual obligations, including any warranty and liability claims,
- to comply with statutory retention obligations, in particular under tax and commercial law,
- to ensure the functionality and security of our systems (e.g. traceability of measurement processes, error analysis, stability and consistency of data sets), and
as required for quality assurance and the long-term comparability of measurement results within the scope of the services agreed with you.
We will only continue to store data that is more than ten (10) years old to the extent and for as long as this
- is necessary for the fulfilment of the contract due to an active account / user account,
- is strictly required by statutory retention obligations, or
- is necessary for the assertion, exercise or defence of legal claims.
Furthermore, we regularly review the continued storage of such data and will delete or anonymise/pseudonymise it as soon as the aforementioned purposes no longer apply. However, we do not guarantee the storage of such data, as this may depend on technical circumstances, system migrations and backup cycles. In all other respects, the contractual provisions apply to the customer’s claims regarding data backup.
The processing and storage of measurement data and account data takes place
- for the fulfilment of the contract and the performance of the user agreements concluded with you on the basis of Article 6(1)(b) of the GDPR,
- to comply with legal obligations, in particular tax and commercial law retention periods, on the basis of Article 6(1)(c) of the GDPR, and
- to safeguard our legitimate interests in the stability, security and consistency of our systems, as well as in the quality assurance of measurement results, in accordance with Article 6(1)(f) of the GDPR. In doing so, we ensure that your interests and fundamental rights do not take precedence and that the storage period is limited to what is necessary for these purposes.
Deletion of data from inactive accounts
A user account is deemed inactive if no new measurement data has been stored for a period of two (2) years.
Once these 24 months have elapsed, we will inform the relevant account administrators designated to us on a monthly basis for a period of three (3) months about the impending deletion of the inactive account and will draw their attention to the option of backing up all data locally using the internal export function.
Once this reminder period has expired, we shall delete all personal data and measurement data contained in the inactive account in accordance with Article 17 of the GDPR (‘Right to erasure’), as well as upon the cessation of the purpose of processing and provided that no statutory retention obligations applicable to us preclude immediate deletion.
System and security logs that are not personal data or contain only pseudonymised data may continue to be stored for reasons of IT security, error analysis and the traceability of system events. Where we use such logs, we ensure that the identification of data subjects is only possible for as long as is necessary for these security purposes, and subsequently carry out further pseudonymisation or anonymisation.
Who are the recipients of data and what data sources are used for this purpose?
Where permitted by law and necessary for the purposes stated, we disclose personal data to service providers and third parties in the following categories: IT, hosting, support and notification service providers, as well as public authorities in justified cases, e.g. social security institutions, tax authorities, the police, the public prosecutor’s office or supervisory authorities.
Cooperation with data processors and third parties
Where, in the course of our data processing, we disclose data to other individuals or organisations (data processors or third parties), transfer it to them or otherwise grant them access to the data, this is done only on the basis of a legal authorisation (e.g. where the transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract in accordance with Article 6(1)(b) of the GDPR), you have given your consent, a legal obligation requires it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.). The disclosure or transfer of personal data to other individuals and organisations (data processors or third parties) takes place only on the basis of a legal authorisation, consent, a legal obligation or our legitimate interests. In the case of IT, hosting, support and notification service providers, this applies only insofar as their involvement is necessary for the respective purposes.
Where service providers process personal data on our behalf, we enter into a contract with them in accordance with Article 28 of the GDPR, where necessary. For SaaS and distributor relationships, the relevant contract together with a data processing agreement (DPA) shall apply in addition.
Transfers to third countries
Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in connection with the use of third-party services or the disclosure or transfer of data to third parties, this will only take place if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to statutory or contractual authorisations, we shall only process data in a third country, or have it processed there, where the specific conditions set out in Articles 44 et seq. of the GDPR are met. This means that processing takes place, for example, on the basis of specific safeguards; in particular, the data importer guarantees an adequate level of data protection in accordance with the EU Standard Contractual Clauses for the transfer of personal data to data processors in third countries. A copy of the Standard Contractual Clauses issued by the European Commission can be found online at:
The customer data collected will be deleted once the order has been completed or the business relationship has ended. Statutory retention periods remain unaffected.
What rights do you have regarding your data?
Lilian Labs GmbH is responsible for the processing of your data, unless otherwise stated. You have the right at any time to obtain, free of charge, information regarding the origin, recipients and purpose of the processing, as well as the right to rectification, erasure and restriction of the processing of your personal data. Subject to the conditions set out in Article 20 of the GDPR, you also have a right to data portability. You may object to the processing on grounds relating to your particular situation, or to processing for direct marketing purposes in accordance with Article 21 of the GDPR . For this and any further questions regarding data protection, you may contact us at any time at the following address: Lilian Labs GmbH, Salzdahlumer Straße 196, 38126 Braunschweig. Furthermore, you have the right to lodge a complaint with the relevant supervisory authority.
Cookies and other technologies
When you visit our website, cookies and other technologies may be used to store or retrieve information on your device. Technically necessary storage or access takes place only to the extent permitted by law. We only use non-essential analytics, marketing or similar technologies after obtaining valid consent in accordance with Section 25 of the TDDDG and Article 6(1)(a) of the GDPR. You may withdraw any consent you have given at any time with future effect via the consent settings.
The specific tools and providers used in each case, the purposes for which they are used, how long information is stored and whether data is transferred to third countries are set out in detail in the consent management section or the current list of tools. Where processing is carried out on a different legal basis, we provide information on this in the relevant sections of this privacy policy.
General information and mandatory details
Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.
Data breaches are reported, assessed and dealt with internally by us without delay. Where required by law, a report is made to the competent supervisory authority within 72 hours of becoming aware of the breach, and data subjects are notified if there is likely to be a high risk to their rights and freedoms. This provision does not relate to any specific incident.
Information on the data controller
The data controller for data processing on this website is:
Lilian Labs GmbH
Salzdahlumer Straße 196
38126 Braunschweig
Germany
Telephone: +49 531 38727436
Email: info@lilianlabs.com
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).
Furthermore, the following entities are also responsible for the use of the LILIAN app within their respective jurisdictions:
Germany: Lilian Labs GmbH, Salzdahlumer Str. 196, 38126 Braunschweig; Dr. Nüsken Chemie GmbH, Poststrasse 14, D-59174 Kamen; WTG Deutschland GmbH, Am Silberg 3, 59494 Soest
Switzerland: Niederer Schneider AG, Breitenstrasse 16b, 8500 Frauenfeld, Switzerland; Dr. Nüsken Chemie GmbH, Poststrasse 14, D-59174 Kamen, Germany
Austria: Dr. Nüsken Chemie GmbH, Poststrasse 14, D-59174 Kamen, Germany
Norway: EnviroProcess Sweden AB, Borgås gårdsväg 9, 434 39 Kungsbacka, Sweden
Sweden: EnviroProcess Sweden AB, Borgås gårdsväg 9, 434 39 Kungsbacka, Sweden
Denmark: EnviroProcess Sweden AB, Borgås gårdsväg 9, 434 39 Kungsbacka, Sweden
Finland: EnviroProcess Sweden AB, Borgås gårdsväg 9, 434 39 Kungsbacka, Sweden
France: Syclope Electronique, Rue du Bruscos, 64230 Sauvagnon, France
Iceland: Laugin ehf, Smiðjuvegur 2, 200 Kópavogur, Iceland
Belgium: Van den Heuvel Watertechnologie, Glashorst 114, 3925 BV Scherpenzeel, Netherlands
Netherlands: Van den Heuvel Watertechnologie, Glashorst 114, 3925 BV Scherpenzeel, Netherlands
Please note that you may always contact the organisation mentioned at the beginning of this document with any data protection enquiries.
Withdrawal of your consent to data processing
Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. To do so, simply send us an informal email. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal. Insofar as the processing is based on your consent, Article 6(1)(a) of the GDPR forms the legal basis.
Right to lodge a complaint with the competent supervisory authority
In the event of breaches of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the State Data Protection Commissioner of the federal state in which our company is based. A list of data protection commissioners and their contact details can be found via the following link:
http://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
Right to data portability
You have the right to have data which we process automatically on the basis of your consent or in fulfilment of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another data controller, this will only take place insofar as it is technically feasible.
Access, Restriction, Erasure
In accordance with the applicable legal provisions, you have the right at any time to obtain, free of charge, information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, the right to have this data rectified, restricted or erased. You may contact us at any time at the address given in the legal notice regarding this matter or any other queries relating to personal data.
Deletion and Backup Storage
Upon deletion of an account or individual data, access for all users of the account ceases immediately. Deleted data can only be restored in accordance with the backup procedures described below and subject to the conditions set out therein.
Deleted data remains stored exclusively in incremental backups for a period of one (1) year. These backups serve solely to ensure system integrity and recoverability in the event of technical faults and are not processed in production environments. Storage in backups is based on our legitimate interests in the security and stability of our systems in accordance with Article 6(1)(f) of the GDPR. As part of our data erasure policies, we ensure that deleted data is not re-imported into production systems during regular recovery processes.
Deleted data may be restored from backups at the express request of the account holder, subject to a fee. The costs depend on the technical effort involved and will be communicated before the restoration is carried out.
In this case, we process the relevant personal data once again for the purpose of restoring the data set requested by the account holder on the basis of
- the performance of a contract (Article 6(1)(b) of the GDPR), insofar as the restoration is necessary for the provision of the agreed services, or
- express consent (Article 6(1)(a) of the GDPR), insofar as it constitutes an additional service going beyond the scope of the contract.
We document all deletion processes and the reasons therefor in accordance with Article 5(2) of the GDPR (‘accountability’). This documentation is used exclusively for and verification purposes vis-à-vis supervisory authorities and to ensure the proper implementation of our data deletion policies.
Objection to promotional emails
We hereby object to the use of contact details published in accordance with the legal requirement to provide an imprint for the purpose of sending unsolicited advertising and information material. The operators of this website expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example via spam emails.