Version of 11 November 2026
Privacy
This notice covers cardinalos.org and requests for an availability notification. It does not describe the future operating system, which is still in development.
Controller and contact
The controller is CodLab UG (haftungsbeschränkt), St.-Jakob-Straße 6, 93161 Sinzing, Germany. For questions or to exercise your rights: info@codlab.de, telephone +49 941 20 90 28 62.
What we ask for and why
Subscription is optional. We process your email address, selected language, request and confirmation dates, consent version and token digests to notify you when CardinalOS becomes available. The legal basis is consent (Article 6(1)(a) GDPR). Without these data we cannot provide the notice; you can still read the entire site.
Two steps, one explicit choice
The consent box is empty. After your request we send a verification email: opening the link displays a page, and only pressing the confirmation button activates the subscription. The token expires after 24 hours and can be used once. Tokens are stored only as cryptographic digests.
Withdrawal, deletion and retention
You can withdraw consent free of charge using the email link and pressing “Withdraw and delete”, or by writing to info@codlab.de. Withdrawal immediately deletes the list entry and does not affect the lawfulness of prior processing. Unconfirmed requests expire after 24 hours; confirmed subscriptions after 365 days. Hourly cleanup deletes expired entries. The list must be deleted after the notice is sent. Technical backups, if enabled during deployment, must expire within 30 days; deletions must be reapplied before any restoration.
Protecting the form
Only when the form is submitted do we use an HMAC digest of the network address in hourly counters to limit abuse. We do not store the IP in those counters or link them to the email. They expire at the end of the hour and are removed by hourly cleanup. The legal basis is our legitimate interest in service security (Article 6(1)(f) GDPR). These are not visit statistics.
Cookies, requests and technical logs
The site uses no analytics, pixels, profiling or third-party resources. The language is in the URL. A technical CSRF cookie, HttpOnly and SameSite=Lax, protects forms for at most one hour, renewed when a form is opened; merely visiting does not create a session. Infrastructure security logs may contain IP, date, path and response status; the deployment plan requires token links to be excluded and a maximum retention of 7 days, without statistical reuse (Article 6(1)(f) GDPR).
Recipients and transfers
Access is limited to authorised CodLab staff and contracted infrastructure and mail providers as necessary, under Article 28 GDPR agreements. We do not sell addresses or share them for advertising. No transfer outside the EEA is planned for this list; any change requires safeguards to be checked and this notice to be updated before processing.
Your rights
You may request access, rectification, erasure, restriction and portability where Articles 15–20 GDPR apply, object to processing based on legitimate interests (Article 21), and withdraw consent (Article 7). You may complain to a supervisory authority, in particular the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. We make no automated decisions and carry out no profiling.