Privacy notice

1. Controller

The controller for data processing on this website and for the purposes described below is:

MTSD (Tarik Muminovic)
Bosanska bb
70240 Gornji Vakuf-Uskoplje
Bosnia and Herzegovina

Privacy requests and objections: privacy@mtsdlabs.com, via WhatsApp or by post to the address above. General contact: contact@mtsdlabs.com.

2. Overview

We process personal data when you visit this website (sections 3 and 4), when you message us (section 5), when we check whether your business has a website of its own and write to you by letter (section 6), and when you become a client (section 8). For texts, translations and evaluations we use the AI model Claude (section 7). This website has no analytics tools, no advertising cookies and no third-party content; fonts and images are served from our own server.

3. Visiting this website

This website is delivered by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) as our processor. When you open it, your browser transmits technically necessary data: IP address, date and time, requested address, referrer and browser identifier. Cloudflare processes these to deliver the pages and to fend off attacks. We do not keep access logs ourselves and do not analyse visits to this website.

Only when you open the start address mtsdlabs.com is the country of your IP address evaluated once, to send you to the German or English version. It is not stored.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and functional provision of the website. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); the EU standard contractual clauses also apply.

4. Language cookie and display

This website sets exactly one cookie: lang with the value de or en. It is set only when you choose a language with the language switcher and stores that choice for 365 days, so that you land directly in your language the next time you open mtsdlabs.com. If you switch between the light and dark colour scheme, your browser stores that choice in local storage (localStorage, key theme); this value is not transmitted to us.

Both are strictly necessary for a function you have expressly requested (§ 25(2) no. 2 TDDDG) and therefore need no consent. Neither value contains an identifier or is analysed. You can delete both at any time in your browser settings. We use no other cookies or similar technologies.

5. Contact via WhatsApp or email

When you message us, we process your name, your phone number or email address, the content of your messages including attachments, and the time, in order to answer your request and, where applicable, to prepare a contract. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and, for general enquiries, Art. 6(1)(f) GDPR (legitimate interest in answering).

We use these processors:

• WhatsApp Business Platform: Meta Platforms Ireland Ltd., Ireland (transmission of WhatsApp messages; Meta may transfer data to the USA).
• Microsoft 365: Microsoft Ireland Operations Ltd., Ireland (email mailboxes).
• Supabase: Supabase, Inc., USA, with servers in Frankfurt am Main (database in which we assign messages to your case).

For transfers to the USA these providers rely on the EU-US Data Privacy Framework or the EU standard contractual clauses (Art. 45, 46 GDPR). To translate your messages and to draft replies we also use Claude by Anthropic (section 7).

Retention: if no order results from the contact, we delete your messages and contact details 12 months after the last contact. Section 8 applies to clients.

6. Businesses we check and write to (Art. 14 GDPR)

We look for businesses without a website of their own, check this carefully, design a website draft for suitable businesses and write to them once by letter. We do not collect these data from you directly.

• Sources: public business listings on Google Maps (Google Places), retrieved through Google’s interface, and our own website check (see purposes). On request we tell you which source we used for your business.
• Categories: business name (and, where it appears in public information, the company or owner name), business address, trade and listing categories, the listing identifier, business status, for businesses not yet open the announced opening date, the number of reviews (not their content), the date we first saw the listing, the result of the website check with evidence (checked addresses, search query, DNS lookups), a selection score with its components, and a code for the letter. We do not retrieve phone numbers or opening hours.
• Purposes: (1) checking whether your business already has a website of its own: we open the website given in the listing, search with the business’s name and address through the Brave Search API and check obvious domain names. We never write to businesses that have a website of their own. (2) Selecting which businesses we write to. (3) Designing a website draft and sending a one-time offer by letter (direct marketing). (4) Avoiding writing to anyone again. (5) If you reply, further coordination.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is presenting our offer by post to businesses without a website (recital 47 GDPR) and writing only to businesses for which it fits. We write only by letter, never by advertising email, text message or phone call. We decide on every letter ourselves.
• Your draft: after the letter is sent it is online for 30 days at its own address, labelled as a concept and blocked for search engines. After that we take it offline.
• Visits to the draft: we count whether and how often the draft is opened. Per visit we store only the time (rounded to the minute), the device type (smartphone, tablet, computer), the country and whether the QR code from the letter was used; from this we derive first and last visit, the number of visits and the number of days with visits. We do not store IP addresses, browser identifiers or referrers, and the draft sets no cookies. We delete the individual visits after 90 days; the summary stays with the case and is deleted with it.
• Recipients: Brave Software, Inc., USA (website check: search query with the business’s name and address; according to Brave, search queries are kept for at most 90 days; according to Brave, search queries are not linked to any identifier of a person; search queries are excluded from Brave’s data processing addendum, and we have not concluded a separate contract with standard contractual clauses with Brave), Pingen GmbH, Zurich, Switzerland (printing and posting the letter; an adequacy decision exists for Switzerland) and its postal service providers, Cloudflare (hosting the draft), Supabase (database), Anthropic (section 7) and, if you reply, Meta or Microsoft as in section 5.
• Retention: if we have written to you, we keep the data for 12 months after the letter. Businesses we do not write to after the check are kept for 12 months after the check, so that we do not check them again. After that we keep only a block entry: the listing identifier, checksums of name and address, the reason and the date, but no name and no address in plain text. This ensures that we never write to anyone twice. If you reply to us, sections 5 or 8 apply from then on.

7. AI model Claude (Anthropic)

We use the AI model Claude through a Claude subscription for individual users. Claude receives the following data:

• During the website check: the details from the business listing and the check evidence, to classify the result.
• For the website draft: the public details of your business, to word the texts of the draft and to review the draft. Claude does not word the letter; it consists of text blocks we have approved.
• For messages: the content of your messages, to classify and translate them and to draft replies.

We review and send every reply, every draft and every letter ourselves; Claude makes no decisions. The legal basis is Art. 6(1)(f) GDPR (efficient handling).

The provider is Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. Anthropic processes the data as a controller in its own right under its consumer terms and privacy policy; there is no data processing agreement for this subscription. Use of our content to train Anthropic’s models is switched off in our account. According to Anthropic, the data are then kept for 30 days; content flagged by Anthropic’s safety systems for up to 2 years. For the transfer to the USA, Anthropic refers to adequacy decisions, standard contractual clauses and statutory derogations; we have not concluded a separate contract with standard contractual clauses with Anthropic.

8. Clients

If you become a client, we process your contract, invoicing and payment data to perform the contract (Art. 6(1)(b) GDPR) and to meet statutory retention obligations (Art. 6(1)(c) GDPR). Depending on the service, we use a domain registrar (INWX GmbH, Berlin) and Cloudflare for your domain and website.

Retention: twelve months after the contract ends, we reduce your client record to what we must keep: agreements, invoices (with the customer data printed on them) and payments are kept for ten years, business correspondence for six years, each counted from the end of the calendar year in which it arose (cf. § 147 AO, § 257 HGB). All other data are deleted earlier under the rules of sections 5 and 6.

Offer page: you open your offer through a personal link (mtsdlabs.com/angebot/…). The page loads the offer with the code from the link directly from our database (Supabase, section 5); the provider records technical access data, including the requested address, in its logs. If you accept the offer, we store the time, the accepted version (checksum) and your two confirmations (acting as a business, note on refunds and defect rights). The legal basis is Art. 6(1)(b) GDPR. The page sets no cookies, sends no referrer and is blocked for search engines.

9. Your right to object (Art. 21 GDPR)

You can object to the processing of your data for direct marketing at any time, without giving reasons. The simplest way: a short “STOP” message via WhatsApp, an email to privacy@mtsdlabs.com or a letter to the address in section 1. We take any draft that is still online offline, will not write to you again and keep only the block entry described in section 6. You can also object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

10. Your other rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence or place of work.

You are under no obligation to provide us with data. There is no automated decision-making, including profiling, with legal effect on you; we decide on every letter ourselves.