1. Controller The controller within the meaning of the General Data Protection Regulation (GDPR) is: Loxo Labs GmbH, Kaulbachstr. 64, 80539 Munich, Germany Register Court: Munich Local Court | Commercial Register: HRB 308663 Managing Director: Emanuel von Grolman Website: www.loxolabs.com | Email: [insert info@loxolabs.com]

2. General Information on Data Processing We process personal data only to the extent necessary to provide a functional website and our services. Processing occurs either with user consent or where permitted by law. Legal bases include Art. 6(1)(a) consent, (b) contract performance, (c) legal obligation, and (f) legitimate interest.

3. Website Access and Log Files When you visit our website, our system automatically collects data including IP address, date/time of access, browser type and version, operating system, referrer URL, pages visited, and data volume. This data is stored in system log files but not combined with other personal data. Legal basis: Art. 6(1)(f) GDPR. Data is deleted once no longer needed.

4. Hosting This website is operated by an external hosting provider. Personal data collected on this website — including IP addresses, contact requests, and access data — is stored on the hosting provider's servers to ensure secure and efficient delivery of our services. Legal basis: Art. 6(1)(f) GDPR; processing is governed by a data processing agreement per Art. 28 GDPR.

5. Contact by Email When you contact us by email, your personal data (e.g. name, email address, message content) is stored solely to process your inquiry and not shared without your consent. Legal basis: Art. 6(1)(b) GDPR for contract-related inquiries; Art. 6(1)(f) GDPR for all others.

6. Recipients of Personal Data Personal data is only shared with third parties where required for contract performance, required by law, consented to, or justified by a legitimate interest under Art. 6(1)(f) GDPR.

7. Retention Period Personal data is retained only as long as necessary for its purpose. Data subject to statutory retention obligations (e.g. commercial or tax law) is deleted after the applicable period expires.

8. Your Rights You have the following rights regarding your personal data: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). Any consent given may be withdrawn at any time.

9. Right to Lodge a Complaint You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

10. Data Security We implement appropriate technical and organizational measures to protect your data against manipulation, loss, destruction, or unauthorized access. Our security measures are continuously updated in line with technological developments.