As of: July 9, 2025
The protection of your personal data is a major concern for LOLABER (hereinafter “LOLABER” or “we”). This Privacy Policy informs you about which personal data we collect, process, and use in the course of our business activities and the use of our website.
1. Name and Contact Information of the Controller
Ulrike Dittgen-Noweski
LOLABER by LorL GmbH
Hebewerkstr. 95
16248 Niederfinow
2. Purposes and Legal Bases for Processing Personal Data
We process personal data for the following purposes and on the basis of the stated legal grounds:
a) Contact and Communication:
* Purpose: Answering inquiries (e.g., via contact forms, email, phone), communication for the initiation and execution of contracts.
* Data Categories: Name, email address, phone number, content of the message.
* Legal Basis: Art. 6 (1) lit. b GDPR (performance of a contract or pre-contractual measures) or Art. 6 (1) lit. f GDPR (legitimate interest in communicating with prospective customers and clients).
b) Provision of Our Services (Avatar Production and Communication Solutions):
* Purpose: Creation of digital avatars, development of scripts and content, voice integration, technical provision, and support.
* Data Categories:
* Identification Data: Name, first name, title (of the person to be avatarized).
* Contact Data: Email address, phone number (of the contact person at the client’s company).
* Biometric Data/Image and Audio Recordings: Photos, video recordings, audio recordings of the person to be avatarized. Note: The processing of this data is carried out exclusively on the basis of the data subject’s express consent (Art. 9 (2) lit. a GDPR) or another suitable legal basis that the client, as the controller, ensures.
* Content Data: Texts, scripts provided by the client, which may contain personal information (e.g., names of students, teachers, parents in example scenarios). Note: The client is responsible for this data as the controller and must ensure the legality of its provision. We process this data as a data processor in accordance with Art. 28 GDPR.
* Legal Basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 9 (2) lit. a GDPR (express consent for biometric data).
c) Marketing and Customer Relationship Management:
* Purpose: Sending newsletters, information about new products and services, invitations to events, using references (with consent).
* Data Categories: Name, email address, company name.
* Legal Basis: Art. 6 (1) lit. a GDPR (consent) or Art. 6 (1) lit. f GDPR (legitimate interest in direct marketing to existing customers).
d) Operation and Optimization of Our Website:
* Purpose: Ensuring functionality, analyzing user behavior to improve the offering.
* Data Categories: IP address, browser information, pages visited, duration of stay.
* Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest in a functional and optimized online offering). Possibly Art. 6 (1) lit. a GDPR for cookies that require consent.
e) Fulfillment of Legal Obligations:
* Purpose: Compliance with statutory retention obligations (e.g., tax law, commercial law).
* Data Categories: Invoice data, contract data.
* Legal Basis: Art. 6 (1) lit. c GDPR (fulfillment of a legal obligation).
3. Recipients of Personal Data
Within LOLABER, only those individuals who need access to your data to fulfill our contractual and legal obligations have access to it.
Your data will only be passed on to third parties if:
* You have given your explicit consent (Art. 6 (1) lit. a GDPR).
* It is necessary for the performance of the contract with you (Art. 6 (1) lit. b GDPR), for example, to technical service providers for hosting or language service providers.
* A legal obligation exists (Art. 6 (1) lit. c GDPR).
* The disclosure is necessary for the establishment, exercise, or defense of legal claims and there is no reason to assume that you have a predominant legitimate interest in your data not being disclosed (Art. 6 (1) lit. f GDPR).
As part of data processing in accordance with Art. 28 GDPR, we use service providers who are strictly bound by our instructions and have been contractually obligated to comply with data protection. This applies in particular to hosting providers and technical service providers who are necessary for the creation and provision of the avatars.
4. Transfer of Data to Third Countries
A transfer of personal data to recipients in third countries (outside the European Union or the European Economic Area) only takes place if:
* It is necessary for the performance of the contract.
* You have given your explicit consent.
* It is required by law.
* Suitable safeguards for an adequate level of data protection are in place (e.g., EU Standard Contractual Clauses, EU Commission’s adequacy decision).
Our servers for avatar production are located within the EU.
5. Storage Duration of Personal Data
We store your personal data only as long as is necessary to achieve the stated processing purposes or if a statutory retention period exists.
* Contract Data: Is stored for the duration of the contractual relationship and beyond, in accordance with statutory retention obligations (e.g., 10 years for commercial and tax law).
* Communication Data: Is generally stored for the duration of the processing of your request and for traceability, unless longer statutory retention periods exist.
* Avatar Production Data (biometric data): Is only stored for as long as is necessary for the creation and provision of the avatar and the consent of the data subject is available. After the termination of the contractual relationship and the expiry of any statutory periods, this data is deleted or anonymized.
6. Your Rights as a Data Subject
You have the right at any time to:
* Information (Art. 15 GDPR): Request information on whether and which personal data we process about you.
* Rectification (Art. 16 GDPR): Demand the immediate correction of inaccurate personal data or the completion of incomplete personal data.
* Erasure (Art. 17 GDPR): Demand the erasure of your personal data stored with us, unless processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
* Restriction of Processing (Art. 18 GDPR): Demand the restriction of the processing of your personal data if the accuracy of the data is contested by you, the processing is unlawful, but you oppose its erasure and we no longer need the data, but you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing.
* Data Portability (Art. 20 GDPR): Receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request its transmission to another controller.
* Objection (Art. 21 GDPR): Object to the processing of your personal data for reasons relating to your particular situation or if the objection is directed against direct marketing.
* Withdrawal of Consent (Art. 7 (3) GDPR): Withdraw your consent given to us at any time. This means that we may no longer continue the data processing that was based on this consent in the future.
* Complaint to a Supervisory Authority (Art. 77 GDPR): Lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you violates the GDPR. The supervisory authority responsible for us is: [Name and address of the competent state data protection authority, e.g., The Berlin Commissioner for Data Protection and Freedom of Information].
7. Obligation to Provide Personal Data
Within the scope of our business relationship, you must provide the personal data that is necessary for the establishment and execution of a business relationship and the fulfillment of the associated contractual obligations or for which we are legally obligated to collect. Without this data, we will generally have to refuse to conclude the contract or provide the service, or we will no longer be able to carry out an existing contract.
8. Changes to this Privacy Policy
We reserve the right to adapt this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services in the Privacy Policy, e.g., when introducing new services. The current Privacy Policy will then apply to your next visit.