Privacy Policy

Last updated 26 October 2026.

This policy explains what personal data Penumbral Labs handles through this website, in our correspondence and calls, and in our business contacts: what we collect, why, on what legal basis, who else handles it, how long we keep it, and your rights under the General Data Protection Regulation (EU) 2016/679 (GDPR).

Who is responsible

The controller is Penumbral Labs S.à r.l.-S, a société à responsabilité limitée simplifiée under Luxembourg law, 40, rue Emile Mark, L-4620 Differdange, Luxembourg, R.C.S. Luxembourg B312553. For any question about your data, or to exercise your rights, write to info@penumbrallabs.com.

When you email us

We process your name, email address, message and anything else you choose to send, to reply to you and, if you ask, to discuss or prepare work. When you ask about our services for yourself, the legal basis is taking the steps you request before a possible contract (Article 6(1)(b) GDPR). When you write for your organisation, or about anything else, it is our legitimate interest in answering and, where it leads there, preparing a contract with your organisation (Article 6(1)(f)). We keep business correspondence for ten years from the end of the financial year concerned, as Luxembourg law requires of businesses (Commercial Code, articles 14 and 16; Article 6(1)(c)).

Our mail server keeps logs of the messages it sends and receives (email addresses, time and the sending server’s IP address) for about one month to keep our email secure and working, and then deletes them (Article 6(1)(f)).

Email we send is relayed by Brevo (Sendinblue SAS, France), our processor for outgoing messages. Brevo adds a small invisible image and changes the links in each message, so that it can count opens and clicks. We have switched on Brevo’s anonymised tracking, so these events are not linked to you: your email address and IP address are anonymised in them. The legal basis is our legitimate interest in knowing, in aggregate, whether our email reaches its readers (Article 6(1)(f)). Brevo keeps a record of each message it relays, including the recipient’s address, the date and whether it was delivered, for 24 months and then deletes it. Brevo also uses some data as a controller for its own purposes, such as billing and statistics.

When you visit this website

We count visits with Umami, which runs on our own server rather than a third-party service. It sets no cookies and does not store your IP address. At the moment of a visit, your IP address is used to estimate an approximate location, to the level of a city, and, with your browser’s identification, to compute a code that groups the pages viewed from the same browser in the same month. The code is computed with a secret key and changes every month; the IP address itself is then discarded. For each page viewed, Umami records the address and title of the page, without the part of the address after a question mark, and the referring site, the browser, operating system, device type, screen size and language. It honours your browser’s Do Not Track setting. The script reads one setting in your browser’s local storage, which can switch the measurement off, and stores nothing there.

We use only Umami’s totals, to see how much traffic the site receives and to find pages that do not work. The data stays on our server, is not shared or combined with other data, and does not follow you to other sites. The legal basis is our legitimate interest in running the site (Article 6(1)(f)). We delete these records after 25 months.

Like any web server, ours keeps access logs, which include your IP address, the time, the full address of the page requested, the referring page and your browser’s identification, for about two weeks to keep the site secure and working, and then deletes them. The legal basis is our legitimate interest in the security and operation of the site (Article 6(1)(f)).

The free self-check on our CRA page runs entirely in your browser. Your answers are not sent to us and not stored.

When you book a call

You can book a call with us by email, and choose a phone call or a Zoom call. We use what you tell us to arrange and prepare it: your name, email address and company, the product you want to discuss, the times that suit you, your phone number if you want to be called, and the email addresses of any colleagues you want on the call. For a Zoom call we send you the invitation by email. If you would rather not give us these details, we cannot hold the call, but you can still write to us.

If you choose Zoom, Zoom Communications, Inc. processes, as our processor, when you join the call, your IP address and technical data about your device and connection, your voice, the name you enter and anything else you share, such as chat messages or, if you switch your camera on, your image. Zoom also uses some of this data for its own purposes, as a separate controller. Zoom’s privacy statement (zoom.com/en/trust/privacy/privacy-statement) explains how it uses data.

When you book for yourself, the legal basis is taking the steps you request before a possible contract (Article 6(1)(b) GDPR). When you book for your organisation, or a colleague puts you on the call, it is our legitimate interest in preparing and holding the call (Article 6(1)(f)). We keep the details of a call as we keep business contacts: if no business follows, we delete them 24 months after our last contact.

We do not record calls, and we do not use AI note-takers on them.

Business contacts

We contact companies that may need our services: by telephone on their company numbers, or with a LinkedIn connection request, and we email you only if you agree. For this we use the business contact details of people in relevant roles (name, job title, company, business email address and business telephone number), taken from public sources such as company websites, public registers and LinkedIn, and we keep notes of our conversations. The legal basis is our legitimate interest in presenting our services to businesses (Article 6(1)(f)). If you tell us you do not want to be contacted, we stop and delete your details, keeping only what we need to respect that request. Otherwise we delete them 24 months after our last contact if no business follows.

Our LinkedIn page

When you visit or follow our company page on LinkedIn, LinkedIn Ireland Unlimited Company processes data about you under its own privacy policy. LinkedIn gives us statistics about visits and followers. For those statistics, LinkedIn and we are joint controllers under LinkedIn’s Page Insights Joint Controller Addendum (legal.linkedin.com/pages-joint-controller-addendum). LinkedIn is responsible for answering requests about that data; if you send one to us, we pass it to LinkedIn. The legal basis for our part is our legitimate interest in presenting our company on LinkedIn (Article 6(1)(f) GDPR).

Clients and suppliers

We process the contact details of the people we work with at clients and suppliers, and the information needed to perform the contract, invoice and keep our accounts. We receive these details from you or from the organisation you work for. The legal bases are the contract, where you are yourself our client or supplier (Article 6(1)(b)); our legitimate interest in working with your organisation, where you act for it (Article 6(1)(f)); and our legal obligations, including keeping accounting documents and business correspondence for ten years from the end of the financial year concerned (Article 6(1)(c)).

Who else handles your data

• OVH Hosting Limited (Dublin, Ireland) hosts the server that runs this website, Umami, the access logs and our mail server, as our processor. The server is in France (Gravelines).
• Brevo (Sendinblue SAS, Paris, France) relays the email we send, as our processor.
• Zoom Communications, Inc. (San Jose, United States) runs the calls we hold on Zoom, as our processor; it also uses some data for its own purposes, as a separate controller.
• An AI assistant that we use to prepare our work, provided by a company in Ireland that belongs to a group based in the United States; where that work involves personal data, that provider acts as a separate controller, not as our processor. Apart from what Zoom holds for the calls we hold on it, our company files, including contact details and notes, are kept on our own equipment, not with a third-party provider.
• Professional advisers bound by confidentiality, such as our lawyer or accountant, when needed; and public authorities where the law requires it.

We do not sell personal data and do not use it for advertising.

Transfers outside the European Economic Area

Brevo may transfer data outside the European Economic Area to its group companies and service providers. For transfers to the United States it may rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, and otherwise on the Commission’s standard contractual clauses. OVH states that any processing of customer data by its group companies outside the European Economic Area is covered by standard contractual clauses. Zoom processes data in the United States and in other countries where it and its service providers operate; for transfers to the United States it relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, under which it is certified, and otherwise on the Commission’s standard contractual clauses. The provider of the AI assistant we use transfers personal data to the United States and other countries outside the European Economic Area; for those transfers it relies on adequacy decisions, the European Commission’s standard contractual clauses and, in certain situations, exceptions allowed by data protection law. These safeguards are set out in the providers’ data processing terms; we will send you a copy on request.

Your rights

You may ask for access to your personal data, for its correction or deletion, for its processing to be restricted and, where the law gives this right, for data you gave us in a portable format (Articles 15 to 20 GDPR). We answer without undue delay and within one month; for complex or numerous requests we may take two more months, and we tell you why (Article 12(3)).

Where we rely on your consent, you may withdraw it at any time; withdrawing does not affect the lawfulness of what we did before (Article 7(3)).

Your right to object. Where we rely on our legitimate interests, you may object at any time on grounds relating to your particular situation. Where we contact you about our services, you may object at any time without giving a reason, and we stop (Article 21 GDPR).

You may also lodge a complaint with a data protection authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu. You may also complain in the EU or EEA country where you live or work, or where you think the infringement took place (Article 77).

Other points

You are not obliged to give us personal data. Without an email address we cannot reply to you, and if we work together we need the contact and billing details named in the contract to perform it and to invoice. We make no decisions about you by automated means alone and do not profile you.

We update this policy when what we do changes. The date at the top shows the current version.