Privacy Policy

Website www.loados.de

Last updated: 17 August 2026 · Version: 2.0

This English version is a courtesy translation. The German version at www.loados.de/datenschutz is legally binding; in the event of discrepancies, the German version prevails.

1. Controller and contact

The controller within the meaning of Art. 4 no. 7 GDPR for the processing activities described on this website is:

loadOS GmbH
Gesundheitscampus-Süd 17
44801 Bochum
Germany

E-mail: service@loados.de
Website: www.loados.de

Represented by: Nicole Sänger
Register court: Amtsgericht Bochum, HRB 23183
VAT identification number pursuant to Section 27a of the German VAT Act (UStG): DE461915909

Contact for data protection matters: service@loados.de with the subject line "Datenschutz" or by post to the above address.

Relationship to other companies. loadOS GmbH cooperates with LABS.ruhr GmbH, Gesundheitscampus-Süd 17, 44801 Bochum (Amtsgericht Bochum, HRB 19788) on development and technical operation. LABS.ruhr GmbH also appears in the app stores as the provider of the loadOS application. loadOS GmbH is solely responsible for the processing described in this notice in connection with the website www.loados.de; LABS.ruhr GmbH does not act in this respect. For the distinction regarding the platform and the app, see Section 13.

2. Scope of this notice

This notice applies to the website www.loados.de, including all subpages, and to communications conducted via the contact channels offered there. It is addressed to visitors of the website, prospective customers, contact persons at customers, suppliers and investors, and job applicants.

It does not apply to

• processing within the loadOS application (web platform and mobile app); the separate notice under Section 13 applies to this,
• websites and services of third parties to which we link,
• processing carried out under their own responsibility by the operators of app stores and social networks.

Our offering is aimed at businesses and their employees. It is not directed at children, and we do not knowingly collect data from children.

3. Legal bases of processing

We process personal data only where a legal basis exists for doing so. For each processing activity described in this notice, the applicable legal basis is stated. The following may apply:

• Art. 6(1)(a) GDPR — your consent, revocable at any time with effect for the future,
• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures taken at your request,
• Art. 6(1)(c) GDPR — compliance with a legal obligation, in particular retention obligations under commercial and tax law,
• Art. 6(1)(f) GDPR — protection of legitimate interests, provided your interests do not override them; the underlying balancing test is documented by us and may be inspected on request.

Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) additionally applies to the storing of information on your terminal device and the reading of such information.

4. Accessing the website and hosting

The website is not operated by us ourselves but is provided on the Lovable platform.

• Provider: Lovable Labs Incorporated, United States of America; address in the European Union: Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. The provider has appointed a data protection officer (dpo@lovable.dev).
• Purpose: provision, stability and security of the website
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and secure operation of our website by a specialist provider. Your interests do not override this because the processing is limited to what is technically necessary and no profiling takes place.
• Processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
• Third-country transfer: The provider is based in the United States; processing outside the European Union therefore cannot be ruled out. Details and the safeguards we have put in place can be found in Section 15.

This privacy policy and the legal notice (Impressum) can be accessed without registration, at permanent addresses, with a single click from every view, and can be printed and saved.

5. Server log data

When you access the website, your browser transmits technically necessary information, which the provider of the hosting platform stores in log files.

• Categories of data: IP address and the approximate location derived from it, date and time of access, address accessed, volume of data transferred, status code, referring address, browser type and version, operating system, error and session identifiers
• Purposes: delivery of content, detection and remedying of faults, detection and defence against attacks and misuse
• Legal basis: Art. 6(1)(f) GDPR; legitimate interest in operational security and in the traceability of security-relevant events. Art. 32 GDPR also requires measures of this kind.
• Retention period: According to the provider's information, this log data is stored for a maximum of 90 days and then deleted. Where a specific security incident exists, the affected entries are retained until the investigation has been concluded.
• Recipients: the provider named in Section 4
• These data are not combined with any other data sources.

6. Cookies and consent management

6.1 Principle

Information is stored on your terminal device or read from it only to the extent strictly necessary to provide a service expressly requested by you (Section 25(2) no. 2 TDDDG), or where you have given your consent (Section 25(1) TDDDG). The subsequent processing of the personal data thereby obtained is based, in the first case, on Art. 6(1)(f) GDPR, and in the second case, on Art. 6(1)(a) GDPR.

We operate our consent management ourselves, without involving a third-party provider. No data is transmitted to third parties in doing so, and no identifiers are created that would allow recognition beyond this website. Only the information listed in the table under Section 6.2 is stored, and only on your terminal device, not on our servers.

Refusal is possible at the first level of the selection dialogue with the same design, the same size and the same effort as consent. Non-necessary categories are switched off by default. Continuing to scroll, continuing to click, or closing the notice does not constitute consent. Access to all content on this website is possible regardless of your decision.

Where your browser transmits an automated opt-out signal (Global Privacy Control or "Do Not Track"), we treat this as a refusal of all non-necessary processing and do not load the audience measurement tool. In doing so, we take account of end-user settings within the meaning of Section 26(3) TDDDG.

6.2 Overview of the technologies used

This overview is complete. Beyond the entries listed, no information is stored on or read from your terminal device — in particular, we do not use advertising or recognition identifiers, tracking pixels, or fingerprinting techniques to create device profiles.

The information in this table is derived from a technical recording of our website's data traffic before and after consent is given. We repeat this review whenever the website changes.

6.3 Withdrawal and changing your selection

You may withdraw your consent at any time and without disadvantage, with effect for the future. Use the "Cookie settings" button in the footer of every page to do so. Withdrawal is possible with the same level of effort as giving consent. After withdrawal, we delete the consent cookie and no longer load the affected content. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Independently of this, you can delete cookies in your browser at any time and restrict their storage. If you delete the consent cookie, we will ask you again on your next visit.

7. Audience measurement with Plausible Analytics

To understand which content on our website is used, and to be able to improve it, we use the analytics tool Plausible Analytics — exclusively with your consent.

• Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia (commercial register number 14709274)
• Place of processing: exclusively within the European Union. According to the provider's information, website visit data is processed on servers in Germany and does not leave the European Union. No transfer to a third country therefore takes place in this respect.
• Data processed: the address and page title accessed, time of access, referring address, browser type and version, operating system, device category, screen size, the country derived from the IP address, and the IP address in the manner described below.
• Why no profiles are created: Plausible does not set cookies and does not store any information on your terminal device. Your IP address is not stored. A non-reversible checksum is generated from the IP address and browser identifier, incorporating a random value that changes daily. This checksum serves solely to avoid double-counting repeated visits within the same day. Once the random value changes, recognition is impossible. No tracking across multiple websites or devices takes place.
• Purpose: understanding the use of our website in order to improve its content and structure
• Legal basis: your consent under Art. 6(1)(a) GDPR. We obtain this also because the German supervisory authorities interpret Section 25 TDDDG broadly, and even the retrieval of terminal device information such as screen size or browser identifier may be covered. We have therefore deliberately opted for the route of consent rather than relying on a legitimate interest.
• Processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
• Retention period: The statistics generated from the visits are aggregated and do not permit any inference to individual persons. No personal reference exists beyond the day of the visit.
• Withdrawal: via the "Cookie settings" button in the footer of every page

Further information from the provider: https://plausible.io/data-policy

8. Fonts, images and embedded content

• Fonts and icons: All fonts and icons used on this website are delivered by our own server. No connection to third-party servers — in particular, not to Google Fonts — is established in doing so.
• Images and videos: All image files are delivered by our own server. We do not embed images from external servers.
• Third-party embedded content: We do not embed videos, map services, appointment-booking windows, chat windows, social network feeds, social network buttons, or review tools. Accessing our website therefore does not create any connection to third parties other than those described in Section 4 and Section 7.
• Links to external sites: Our website contains links to external websites. By clicking on them, you leave our offering. We have no influence over the processing that takes place there; the privacy policy of the respective provider applies.

9. Getting in touch

9.1 Contact form

• Mandatory fields: name, e-mail address, message. Voluntary fields: company, telephone number. Voluntary fields are marked as such in the form. In addition, the time of submission and technical information for the prevention of automated inputs are processed.
• Purposes: processing your enquiry, preparing and conducting a product demonstration, preventing misuse of the form, evidencing the enquiry process
• Legal basis: Art. 6(1)(b) GDPR, insofar as your enquiry is directed towards a contract; otherwise Art. 6(1)(f) GDPR, with a legitimate interest in responding to enquiries addressed to us and in protecting our systems
• Recipients: Transmission takes place via the infrastructure of our hosting provider (Section 4) in a data centre in Frankfurt am Main. We do not use a separate form or marketing service provider, nor a service to prevent automated inputs, that transmits data to third parties for this form.
• Retention period: see Section 16

9.2 E-mail, telephone and post

If you contact us via one of these channels, we process your details exclusively to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related matters, and otherwise Art. 6(1)(f) GDPR, with a legitimate interest in responding.

Please note that the transmission of unencrypted e-mail is not secured against being viewed by third parties. Please do not send us particularly sensitive information by this means.

We use service providers acting as processors on our behalf for sending and receiving e-mail and for the filing of business correspondence. We will provide their names and countries of establishment on request at service@loados.de; the full disclosure under Art. 15 GDPR includes this information.

10. Job applications

• Categories of data: contact and identity details, application documents and references, information on qualifications and professional experience, notes on interviews
• Purpose: conducting the selection process and deciding on the establishment of an employment relationship
• Legal basis: Art. 6(1)(b) GDPR for the initiation of the employment relationship; Section 26(1) BDSG (German Federal Data Protection Act) has a clarifying character in this respect. For special categories of personal data, for example information on a severe disability, Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. For the defence against claims under the General Equal Treatment Act (AGG), Art. 6(1)(f) GDPR.
• Recipients: the persons involved in the selection decision within our company, and our e-mail service provider
• Retention period: deletion six months after conclusion of the process, provided no legal dispute is pending. Inclusion in an applicant pool takes place only with your separate consent; storage then lasts twelve months and may be withdrawn at any time.
• No automated pre-selection: We do not use software that automatically evaluates, filters out, or ranks applications. Every decision is made by humans.

11. Customers, suppliers and other business partners

• Categories of data: name, role, business contact details, company affiliation, content of correspondence, information on offers, contracts, services, invoices and payments
• Purposes: initiating, concluding and performing contracts, communication, invoicing, receivables management, evidencing business transactions
• Legal basis: Art. 6(1)(b) GDPR, insofar as you are yourself a party to the contract; for contact persons at a company, Art. 6(1)(f) GDPR, with a legitimate interest in conducting the business relationship with your company; Art. 6(1)(c) GDPR for obligations under commercial and tax law. In the event of late payment, we process data to enforce our claims on the basis of Art. 6(1)(f) GDPR.
• Recipients: tax advisers, accounting, banks, and, in the event of a dispute, lawyers and courts
• Retention period: see Section 16

12. Company presence on LinkedIn

We operate a company presence on the professional network LinkedIn. For users from the European Economic Area, the operator is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

The operator processes the data of visitors to our page under its own responsibility and to a substantial extent. We have no influence over, and no access to, the underlying raw data. To the extent we use the aggregated page statistics made available by the network, we are jointly responsible with the operator in this respect pursuant to Art. 26 GDPR.

Legal basis. For operating the presence and using the statistics, we rely on Art. 6(1)(f) GDPR, with a legitimate interest in public relations, customer communication and recruitment. We note that the German supervisory authorities largely consider the consent of visitors to be required for the use of such page statistics. This question has not been conclusively resolved. After weighing the considerations, we have opted for the approach described, use only the aggregated evaluations, and review the matter regularly.

Essential content of the arrangement under Art. 26(2) GDPR. The operator of the network provides the statistics and, to do so, processes data of visitors; we select the criteria by which the evaluation is carried out and use the result in aggregated form. The operator is responsible for informing data subjects about the processing within the network and for fulfilling their rights in relation to that processing; it has undertaken to do so vis-à-vis us. You may nonetheless direct any concerns to us; we will forward them. Liability towards third parties remains unaffected under Art. 82(4) GDPR.

Information from the operator on the processing can be found at https://de.linkedin.com/legal/privacy-policy. The operator also transfers data to the United States; see Section 15.

Accessing our website does not trigger any connection to LinkedIn. We embed neither buttons nor tracking pixels of the network.

13. The loadOS application and links to the app stores

From our website, we link to the offerings of the app stores. By following such a link, you leave our website; processing within the respective store is carried out under the own responsibility of its operator (Apple Inc. or Google Ireland Limited, as applicable).

This notice does not apply to the processing of personal data within the loadOS web platform and the mobile app. There, the company that deploys loadOS regularly decides on the purposes and means of processing and is thus the controller; in this respect, we act on its instructions. A separate privacy notice exists for this processing, which is made available via the app stores and within the application. If you use loadOS on behalf of your employer or client, please direct enquiries regarding your rights to that company first.

LABS.ruhr GmbH currently appears in the app stores as the provider of the application (see Section 1).

14. Recipients and processors

We disclose personal data only where this is necessary to provide our services, where we are legally obliged to do so, or where you have consented. Contracts pursuant to Art. 28 GDPR are in place with service providers who process personal data on our behalf. These service providers are bound by our instructions and may not use the data for their own purposes.

For the processing described in this notice, these are:

In addition, recipients may include: banks in connection with payment processing; lawyers, tax advisers, and courts and authorities, insofar as necessary to assert or defend legal claims or to comply with statutory obligations; in the event of a sale of the business, potential purchasers and their advisers under a confidentiality agreement.

Requests for information from authorities. Where an authority demands the disclosure of data, we examine the request as to its legal basis and its scope, and disclose only what we are obliged to disclose. We comply with requests from authorities in third countries only where they are based on a basis recognised under Art. 48 GDPR.

15. Transfers to third countries

We process data primarily within the European Union and the European Economic Area. Insofar as data is transferred to a third country, this takes place only on the basis of Art. 44 et seq. GDPR.

For Plausible Analytics, no transfer to a third country takes place; website visit data is processed exclusively within the European Union.

Additional safeguards. Where a transfer takes place, we work to ensure that data is encrypted in transit and at rest, that access is limited to what is necessary and is logged, and that the recipient notifies us of requests from authorities, insofar as it is permitted to do so. We limit the categories of data reaching these recipients to what is technically unavoidable.

Residual risk. We note that, in the United States, authorities may under certain conditions access data, and that legal remedies for data subjects are not available there to the same extent as in the European Union.

You may request a copy of the safeguards we have put in place, in particular the standard contractual clauses, at service@loados.de. Trade secrets and information relating to third parties may be redacted in these.

16. Retention period and erasure

We store personal data only for as long as necessary for the respective purpose, and delete it thereafter, unless a statutory retention obligation exists. Where such an obligation exists, we restrict the processing and use the data only to fulfil that obligation.

The periods begin at the end of the calendar year in which the respective matter was concluded, insofar as the provisions referred to so provide. Data backups are overwritten according to their regular cycle; deletion there takes effect no later than after 90 days.

17. Security

We take the technical and organisational measures required under Art. 32 GDPR, in particular: end-to-end encryption of transmissions in line with the state of the art (TLS); encryption of stored data; access control based on the principle of least privilege; multi-factor authentication for administrative access; a restrictive Content Security Policy that technically prevents the loading of external content; logging of security-relevant events; procedures for data backup and recovery; obligating and training our staff, and careful selection and monitoring of our service providers.

We maintain a process for detecting, assessing and handling security incidents. We report notifiable breaches of the protection of personal data to the competent supervisory authority within 72 hours pursuant to Art. 33 GDPR and notify affected data subjects pursuant to Art. 34 GDPR.

Nevertheless, the transmission of data over the internet cannot be fully secured against access by third parties. This notice is provided for information purposes and does not constitute an exclusion of our responsibility.

18. Your rights

You have the following rights against us:

• Access under Art. 15 GDPR to the data processed about you, the purposes, the recipients, the retention period and the origin, as well as the right to a copy
• Rectification of inaccurate data and completion of incomplete data under Art. 16 GDPR
• Erasure under Art. 17 GDPR, unless a retention obligation or another ground for exclusion applies
• Restriction of processing under Art. 18 GDPR, in particular while a request for rectification or objection is being examined
• Data portability under Art. 20 GDPR. This right exists only for processing that is based on consent or a contract and carried out by automated means; it does not exist for processing based on legal obligations or legitimate interests.
• Objection under Art. 21 GDPR to processing based on a legitimate interest — see the notice under Section 19
• Withdrawal of consent under Art. 7(3) GDPR, at any time, without giving reasons and without disadvantage, with effect for the future
• Complaint to a supervisory authority under Art. 77 GDPR — see Section 20

How to exercise your rights. Contact us informally at service@loados.de with the subject line "Datenschutz", or at the postal address given in Section 1. No particular form is required.

We respond without undue delay, and no later than within one month of receipt. For complex requests, we may extend this period by up to a further two months; we will inform you of the extension and the reasons for it within the first month (Art. 12(3) GDPR). Processing is free of charge.

Where there are reasonable doubts as to your identity, we may request additional information necessary to confirm it. We do not require copies of identity documents containing complete information, nor data that we do not already hold.

19. Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data carried out on the basis of Art. 6(1)(e) or (f) GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) GDPR).

Where your personal data is processed for the purposes of direct marketing, you have the right to object at any time and without giving reasons to such processing; this also applies to any profiling connected with such marketing. Following such an objection, your data will no longer be processed for these purposes (Art. 21(2) and (3) GDPR).

The objection is not subject to any particular form and may be addressed to service@loados.de.

20. Complaint to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you may lodge a complaint with a supervisory authority, in particular the authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77(1) GDPR). This choice is yours.

The authority competent for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Telephone: 0211 38424-0
E-mail: poststelle@ldi.nrw.de

21. Whether provision of data is required

Pursuant to Art. 13(2)(e) GDPR, we inform you whether the provision of data is required and what the consequences of not providing it are.

22. No automated decision-making

A decision based solely on automated processing within the meaning of Art. 22(1) GDPR that produces legal effects concerning you or similarly significantly affects you does not take place in connection with this website. We also do not carry out profiling to evaluate or rank prospective customers, and we do not use any AI system on this website with which you interact directly.

23. Changes to this privacy policy

We update this notice where the processing described, or the applicable legal requirements, change. The version currently in force is available at www.loados.de/datenschutz. Every version bears a date and a version number.

A change to this notice does not extend the purposes for which data already collected was obtained. Where we intend to process data for a different purpose, we will inform you in advance pursuant to Art. 13(3) GDPR and examine compatibility under Art. 6(4) GDPR, or obtain your consent.

Change log