Privacy Policy

The protection of your personal data is of particular importance to us. In this privacy policy, we inform you in detail about how your data is handled when you visit our website and use our services.

We process personal data on the basis of the following legal grounds:

• Art. 6 Abs. 1 lit. a DSGVO: Consent of the data subject
• Art. 6 Abs. 1 lit. b DSGVO: Performance of a contract or pre-contractual measures
• Art. 6 Abs. 1 lit. f DSGVO: Legitimate interests in safeguarding our business interests
• Art. 6 Abs. 1 lit. c DSGVO: Compliance with legal obligations

Your personal data will not be transmitted to third parties for purposes other than those listed below.

We only share your personal data with third parties if:

• You have given your explicit consent (Art. 6(1)(a) GDPR)
• the disclosure is necessary for compliance with a legal obligation (Art. 6(1)(c) GDPR)
• this is necessary for the performance of contractual relationships (Art. 6(1)(b) GDPR)

Payment Service Provider: To process payments, we forward your payment data to the credit institution responsible for the payment transaction.

We use cookies on our website. These are small files that your browser automatically creates and stores on your device when you visit our site. Cookies do not cause any damage to your device and do not contain viruses, trojans, or other malware.

The use of cookies serves to make the use of our website more pleasant for you. We use session cookies to recognise that you have already visited individual pages of our website. These are automatically deleted after you leave our site.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer. However, the complete deactivation of cookies may mean that you cannot use all functions of our website.

The tracking measures listed below are carried out on the basis of Art. 6(1)(f) GDPR. With the tracking measures employed, we aim to ensure a demand-oriented design and the continuous optimisation of our website.

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and IP address. This data is not merged with other data sources.

Storage period: Server logs (in particular IP address, user agent and request URL) are retained by our hosting provider Vercel Inc. for a maximum of 30 days and are then deleted automatically (state of the Vercel platform SLA as of May 2026). Edge logs are rotated within a few hours. Longer retention only occurs where required for the investigation of a specific security incident (Art. 6(1)(f) GDPR).

You have the right:

• Art. 15 DSGVO pursuant to Art. 15 GDPR, to request information about your personal data processed by us
• Art. 16 DSGVO pursuant to Art. 16 GDPR, to request the immediate rectification of inaccurate or completion of your personal data stored by us
• Art. 17 DSGVO pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us
• Art. 18 DSGVO pursuant to Art. 18 GDPR, to request the restriction of processing of your personal data
• Art. 20 DSGVO pursuant to Art. 20 GDPR, to receive your personal data in a structured, commonly used, and machine-readable format
• Art. 22 DSGVO pursuant to Art. 22 GDPR, not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you
• Art. 7 Abs. 3 DSGVO pursuant to Art. 7(3) GDPR, to withdraw your consent given to us at any time
• Art. 77 DSGVO pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right pursuant to Art. 21 GDPR to object to the processing of your personal data, insofar as there are grounds relating to your particular situation.

If you wish to exercise your right of withdrawal or objection, an email to info@origin-labs.de is sufficient.

Within our internal sales process, we use AI-assisted lead scoring. Based on your request and interaction data (source, stage history, number of configurations/requests, email engagement, internal notes) we compute a numeric score between 0 and 100 that estimates the likelihood of a future contract. This processing constitutes profiling within the meaning of Art. 4 No. 4 GDPR.

Purpose and legal basis: Sales prioritisation (which leads are contacted first). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient sales operations). A balancing of interests has been performed.

No solely automated decision with legal effect: The score is an internal aid without direct legal effect on you. There is no automatic rejection, preferential treatment or contract decision — the decision on outreach, offer or contract is always made by a human. Art. 22(1) GDPR is therefore not engaged.

Right to manual correction and deletion: You may at any time request a manual correction or full deletion of your lead score. Deletion covers the score, the textual reasoning, the underlying signals and the confidence level. Please send any such request to info@origin-labs.de.

Data transfer to the USA: For the AI-assisted scoring, we transmit the data points relevant to the score computation to OpenAI, OpenAI OpCo, LLC (3180 18th Street, San Francisco, CA 94110, USA). OpenAI is certified under the EU-US Data Privacy Framework (EU Commission adequacy decision of 2023-07-10); a data processing agreement (DPA) under Art. 28 GDPR including the EU Standard Contractual Clauses is additionally in place. Data submitted via the OpenAI API is not used to train OpenAI models (API default as of 2026-05).

Internal knowledge-base queries: In our internal admin area (/admin/ai-suite/wissensbasis), authorised staff can submit natural-language questions to an AI assistant. When a question is submitted, the assistant may — depending on the question — transmit data points from our database to OpenAI (e.g. contact names, company names, email addresses, invoice numbers, stage and score data). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient internal knowledge retrieval). Recipient, data-protection framework and DPA are identical to those described above for lead scoring. Transmission only occurs ad-hoc upon active request by an authorised staff member, not automatically or in the background.

We use the widely-used SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser when you visit our website. You can tell whether an individual page of our website is transmitted in encrypted form by the closed lock symbol in the status bar of your browser.

We also employ appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or against unauthorised access by third parties.

As part of our processing activities, we use the following processors and recipients. Data processing agreements under Art. 28 GDPR exist with all named providers. Transfers to third countries (especially the USA) are based on the EU-US Data Privacy Framework (DPF) and additional Standard Contractual Clauses (SCC) under Art. 46 GDPR.

If you have any questions about data protection, you can contact us at any time:

For complaints, you can also contact the supervisory authority responsible for us: