Wing Labs

Privacy Policy

Last updated: August 15, 2026

1. Data Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Wing Labs GmbH
Grindelberg 61e
20144 Hamburg
Germany

Represented by: Dr. Jan-Rasmus Künnen
Email: hello@winglabs.co

2. Data Protection Officer

We are not required to appoint a data protection officer under Art. 37 GDPR or § 38 BDSG. For any question concerning the processing of your personal data, please contact us at hello@winglabs.co.

3. Legal Bases for Processing

We process personal data only where a legal basis under Art. 6(1) GDPR applies. Depending on the processing activity, the relevant basis is:

  • Art. 6(1)(b) GDPR — processing necessary to perform a contract or to take steps at your request prior to entering into a contract, for example when you send us a business enquiry.
  • Art. 6(1)(f) GDPR — processing necessary for our legitimate interests, in particular operating this website securely and reliably and understanding in aggregate form how it is used.
  • Art. 6(1)(c) GDPR — processing necessary to comply with a legal obligation, in particular statutory retention obligations under commercial and tax law.

4. Hosting and Server Log Files

We operate this website on a virtual server provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The server is located in Germany, and no data is transferred outside the European Union for hosting purposes. IONOS provides the underlying infrastructure and acts as a processor on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. The web server and application software running on that infrastructure are operated by us.

When you access this website, the web server we operate automatically records information that your browser transmits in so-called server log files. This may include:

  • the IP address of the requesting device
  • the date and time of the request
  • the page or file requested and the amount of data transferred
  • the referring URL
  • browser type, browser version, and operating system

This data is not merged with other data sources and is not used to identify you personally. It is processed on the basis of Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free delivery, stability, and security of this website. Because we operate the server ourselves, we control how long these logs are kept: they are deleted or anonymised as soon as they are no longer required for the purposes above.

5. Contact Form and Email Contact

If you contact us via our contact form or by email, we process the data you provide — your name, email address, optionally your company, and the content of your message — in order to handle your enquiry and any follow-up questions.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or to pre-contractual measures, and otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in responding effectively to enquiries addressed to us. Providing this data is voluntary, but without it we cannot respond to your enquiry.

We use a rate limit on the contact form to prevent abuse. For this purpose your IP address is processed temporarily in the server memory and is not stored permanently. The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in protecting our systems against misuse.

Messages submitted through the contact form are delivered to us by email using the transactional email service of Resend, Inc., United States, acting as a processor on our behalf under a data processing agreement pursuant to Art. 28 GDPR. This involves a transfer of personal data to a third country. The transfer is safeguarded by the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR.

We retain your enquiry until it has been fully dealt with and any related business relationship has concluded, unless statutory retention obligations — in particular under § 257 HGB and § 147 AO — require us to keep the correspondence for longer. In that case, processing is restricted to what those obligations require.

6. Cookies and Web Analytics

This website does not use cookies. We do not store any information on your device and do not read any information from it, whether through cookies, browser cache, or local storage. Because no information is stored on or retrieved from your device within the meaning of § 25 TDDDG, no consent banner is displayed.

To understand how our website is used, we use Plausible Analytics, a privacy-focused web analytics service provided by Plausible Analytics, a company incorporated in Estonia. Plausible acts as a processor on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. All analytics data is processed and stored exclusively on infrastructure located in Germany and is not transferred outside the European Union.

Plausible is cookieless and collects only aggregated statistics, such as page views, referring websites, approximate country of origin, and the type of device and browser used. It does not store your IP address, does not create persistent identifiers, and does not track you across visits, across days, or across other websites. No personal data is stored, and the resulting statistics cannot be traced back to individual visitors.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in understanding, in aggregate form, how our website is used so that we can improve its content and structure. You have the right to object to this processing at any time under Art. 21 GDPR — see section 8 below.

Beyond this, we do not use tracking pixels, advertising networks, remarketing, user profiling, or social media plug-ins. Fonts used on this website are hosted on our own servers and are not requested from third-party providers such as Google Fonts, so no connection to such providers is established when you visit this site.

Our website contains a link to our LinkedIn profile. This is a plain hyperlink; no data is transmitted to LinkedIn unless you actively click it and thereby visit LinkedIn’s own website, where LinkedIn’s privacy policy applies.

7. Data Security

This website uses TLS/SSL encryption for all connections to protect the transmission of your data. You can recognise an encrypted connection by the “https://” prefix in your browser’s address bar. We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorised access.

8. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • Access (Art. 15 GDPR) — to obtain confirmation as to whether we process your data and to receive a copy of it
  • Rectification (Art. 16 GDPR) — to have inaccurate data corrected
  • Erasure (Art. 17 GDPR) — to have your data deleted
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used, machine-readable format
  • Objection (Art. 21 GDPR) — to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR
  • Withdrawal of consent (Art. 7(3) GDPR) — where processing is based on your consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, please contact us at hello@winglabs.co.

9. Right to Lodge a Complaint

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Hamburg, Germany
datenschutz-hamburg.de

10. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our website or in legal requirements. The version published on this page at the time of your visit applies. The date of the most recent update is shown at the top of this page.

11. Contact

If you have any questions about this privacy policy or about how we handle your data, please contact us at: hello@winglabs.co