This notice explains how PelagicLabs handles personal data when you visit pelagiclabs.io, contact us by email, or choose optional website analytics. It does not govern data processed inside the GILLI or NORDR mobile apps.
This legally operative notice is currently provided in English. You may contact us to request an explanation in another European language.
1. Controller and contact
- Controller: PelagicLabs
- Country: Belgium
- VAT / enterprise number: BE1032.515.015
- Privacy contact: lukasmeerschaut@pelagiclabs.io
PelagicLabs has not appointed a data-protection officer because the present scale and nature of the processing do not require one. Privacy requests are handled through the contact above.
2. Personal data and sources
2.1 Data you send
Depending on your email or later correspondence, this can include:
- name, email address, company, role, country, and product interest;
- contact topic, subject, message, use case, coverage request, or waitlist interest;
- later correspondence and support history.
2.2 Data generated when the website is used
Hosting and security infrastructure necessarily receives network and request data, which can include IP address, request time, requested URL, HTTP method, browser or user-agent information, referrer, response status, and security or error details.
2.3 Cookies and optional analytics
The website stores your privacy choice and may remember a language selected by you. Vercel Web Analytics and Speed Insights remain off until you explicitly allow analytics. After consent, they can process page, referrer, browser, device, country-level, network-performance, and Web Vitals information as described in the Cookie Policy.
2.4 Sources
We obtain data directly from you, from your browser or device during a request, from Vercel as hosting and optional analytics provider, and from our email provider when you contact us. We do not purchase consumer profiles or enrich website visitors with third-party marketing datasets.
3. Purposes and legal bases
| Purpose | Data | GDPR basis |
|---|---|---|
| Deliver pages, operate the service, diagnose failures, and secure the website | Network, request, security, and error data | Article 6(1)(f): legitimate interests in reliable and secure service operation |
| Answer a contact, support, partnership, waitlist, coverage, or commercial inquiry | Contact details, message, product interest, and correspondence | Article 6(1)(b) for pre-contractual steps; otherwise Article 6(1)(f) in handling requested communications |
| Measure aggregate page use and technical performance | Vercel Analytics and Speed Insights data | Article 6(1)(a): prior consent |
| Remember privacy and language choices requested by you | Consent and locale storage | Article 6(1)(f) and the device-storage exemption for requested or necessary functionality |
| Maintain legal, tax, accounting, security, and dispute records | Relevant correspondence, transaction, and audit information | Article 6(1)(c) legal obligation and Article 6(1)(f) establishment or defence of claims |
Our legitimate interests are operating a secure website, preventing abuse, responding to people who contact us, maintaining continuity of correspondence, and protecting legal rights. You may object to processing based on Article 6(1)(f); we will stop unless compelling legitimate grounds or legal claims justify continuation.
4. Required and optional information
Browsing does not require a name or email. If you contact us by email, processing your message and return address is necessary to reply. You choose what additional context to include and should avoid information that is not needed for your request.
Analytics is optional. Refusing or withdrawing analytics consent does not reduce website functionality.
5. Recipients and processors
Personal data is disclosed only as needed to operate the relevant function:
- Vercel: website hosting, content delivery, security, and optional consented analytics and performance measurement;
- Email provider: delivery and storage of correspondence you choose to send;
- Professional advisers and public authorities: only where necessary for legal advice, compliance, claims, or a lawful request;
- Business-transferee recipients: if a lawful restructuring, sale, or transfer occurs, subject to appropriate confidentiality and notice.
We do not sell website personal data, disclose it to advertising data brokers, or use correspondence for unrelated third-party marketing.
6. International transfers
Some providers or their subprocessors may process data outside the European Economic Area. Where GDPR transfer restrictions apply, transfers must rely on an adequacy decision, the European Commission's Standard Contractual Clauses with any required supplementary measures, or another lawful transfer mechanism. You may ask us for information about the relevant safeguards, subject to protection of confidential and security-sensitive terms.
7. Retention
- Consent choice: up to 6 months, then a fresh choice is requested; withdrawal can occur earlier.
- Language preference: up to 1 year or until you clear it.
- Email correspondence: while the request is active and thereafter only as long as reasonably needed for continuity, security, legal claims, applicable record-keeping duties, or the requested product update.
- Hosting and security logs: according to provider-configured operational and security retention periods.
- Analytics: according to the limited retention configured or documented by Vercel; PelagicLabs uses it only in aggregate after consent.
We periodically review correspondence and delete or anonymise information that is no longer needed. Longer retention applies only where law, fraud prevention, security, an active agreement, or the establishment, exercise, or defence of legal claims requires it.
8. Automated processing
The website uses locale routing and aggregate analytics. It does not make a decision based solely on automated processing that produces legal or similarly significant effects on you within GDPR Article 22.
9. Your rights
Subject to the conditions in applicable law, you may request:
- access to and a copy of personal data;
- correction of inaccurate or incomplete data;
- erasure;
- restriction of processing;
- portability of data you provided where Article 20 applies;
- objection to processing based on legitimate interests;
- withdrawal of consent at any time.
Send requests to lukasmeerschaut@pelagiclabs.io. We may request proportionate information to verify identity. We respond without undue delay and normally within one month; the GDPR permits an extension for complex or numerous requests, with notice of the reason.
You may also complain to the Belgian Data Protection Authority at Rue de la Presse 35, 1000 Brussels, Belgium, telephone +32 (0)2 274 48 00, email contact@apd-gba.be, or through its citizen portal. You may contact the supervisory authority in the EU or EEA country where you live or work as well.
10. Security
We use HTTPS, access controls, and provider security features. No online system can be guaranteed completely secure. Please avoid sending sensitive personal data that is not needed for your inquiry.
11. Children
The website is intended for a general audience and is not designed to solicit personal data from children. A parent or guardian who believes a child sent information without appropriate authority may contact us for review and deletion.
12. Changes
We update this notice when the website, providers, legal bases, or retention practices materially change. The revised date is shown above. Where required, we will request a new consent choice before introducing a new non-essential analytics or marketing technology.