Privacy Policy

LabVitro is a software product for laboratory inventory management that is still under development. This website provides product information about LabVitro and its planned features, and an optional waitlist that lets you register your interest in early access.

The LabVitro application itself is not yet publicly available and is not part of this website. This policy explains how personal data is processed when you use this website, and what your rights are under the EU General Data Protection Regulation (GDPR) and Dutch privacy law (the UAVG).

The personal data processed through this website is processed by Van der Valk Interactive, the operator of LabVitro. The processing takes place in the Netherlands.

Van der Valk Interactive is the intended business name and is not yet a registered company. It has no registration at the Dutch Chamber of Commerce (KvK) and no BTW (VAT) number. LabVitro is currently operated by its founder as a pre-launch activity.

• Intended business name: Van der Valk Interactive (not registered; no KvK or BTW number)
• Country: Netherlands
• Website: labvitro.com
• Privacy contact: general@labvitro.com

Send questions about this policy, and requests to exercise your rights (including deletion requests), to the privacy contact above.

When you visit the website. The website itself does not collect personal data from a visit: it sets no cookies, uses no local storage, and loads no analytics or tracking scripts. The hosting platform may still record standard technical log data about requests, such as the IP address, the time of the request, and the requested page, and retains it according to its own retention settings.

When you join the waitlist. We collect the email address you enter (required), your consent to receive the communications described on the form, and the page on the site where you signed up, which we store as an internal attribution attribute. We also record the date and time of your consent, together with the version of this policy that was on screen, as consent evidence. If a future version of the form asks for the name of your laboratory or organization, we store that as well.

Processing that happens on submission. Your IP address is used temporarily to limit abusive automated submissions; it is not stored or shared. A fill time check is used to reject obvious bot submissions; it is not stored either.

When you contact us. If you write to us, we process the content of your message, your name if you include it, and your email address.

What we do not collect. We do not use analytics or advertising technologies, we do not fingerprint devices, we do not collect payment data, and we do not knowingly process special categories of personal data.

The list below pairs each processing purpose with its legal basis under Article 6 GDPR.

• Manage the waitlist and send the communications described on the form, such as launch updates. Legal basis: your consent, given when you check the consent box on the waitlist form.
• Keep the waitlist accurate, for example by handling duplicate submissions and honoring unsubscriptions. Legal basis: legitimate interest in maintaining a correct and usable list.
• Protect the site from abuse, for example with rate limiting and bot detection on the waitlist form. Legal basis: legitimate interest. These measures are proportionate to the risk they address.
• Answer messages you send us. Legal basis: legitimate interest in responding to people who contact us, and performance of any resulting service relationship.
• Comply with legal obligations and keep the service secure. Legal basis: legal obligation and legitimate interest.

We use Brevo, operated by Brevo S.A. (France), to manage waitlist subscribers and to send the communications described on the waitlist form. Brevo acts as a processor on our behalf, under a data processing agreement, and we remain the controller.

Information shared with Brevo. For each subscriber we share the email address, the list membership, the page on the site where they signed up, and the consent evidence described in Section 3. If a future version of the form collects the name of a laboratory or organization, we share that as a contact attribute. Brevo also processes the technical and delivery related information it needs to provide the service, such as delivery status and bounces.

Unsubscribing. Every marketing email we send includes a working unsubscribe link. When you unsubscribe, you are removed from the marketing audience and excluded from future campaigns.

Withdrawing consent. You can withdraw your consent at any time through the unsubscribe link or by writing to the privacy contact above. Withdrawing consent does not affect the lawfulness of processing before you withdrew it. Subscription consent and individual tracking consent (Section 6) are separate preferences.

Brevo can track email opens and clicks. We have configured the LabVitro account as follows:

• anonymous tracking, so opens and clicks are counted in aggregate without being associated with an identifiable contact;
• individual tracking only for contacts whose tracking consent is known and granted;
• contacts whose consent status is unknown are not individually tracked;
• image URLs are hidden;
• Apple Mail Privacy Protection opens are excluded from the counts;
• known bot activity is excluded from the counts.

Aggregated reporting does not by itself eliminate all privacy obligations. Brevo still processes technical and delivery related data, and tracking technologies remain subject to applicable privacy and electronic communications laws. Anonymous reporting is not a guarantee that no personal data is processed.

The waitlist form does not currently collect tracking consent, so waitlist subscribers are not individually tracked. We do not use individual email engagement data for profiling, and we will not do so unless such processing is actually implemented and lawfully supported.

The website sets no cookies and does not use local storage. It does not load analytics, advertising, or other third party tracking scripts. Fonts are self hosted at build time, so the page makes no third party requests.

The only request a visitor makes beyond the page content and its assets is a waitlist submission, which goes to our own server. Because the site uses no non essential cookies, we do not use a cookie consent banner.

The following providers are relevant to the public website. They process personal data on our behalf only to the extent needed to provide the service.

• Brevo (France). Waitlist subscriber management and campaign delivery.
• Vercel. Hosting for the website.
• Google Workspace. Business email, including contact and support correspondence.

The infrastructure of the LabVitro application (its database and authentication) does not process public visitor information, because the application is not publicly accessible. It is therefore not listed here.

We do not sell or rent personal data, and we do not share it with third parties for their marketing purposes.

Some of our providers are based outside the EEA or may process personal data outside the EEA. Where personal data is transferred outside the EEA, we do so only under an appropriate safeguard, such as an adequacy decision or the EU standard contractual clauses.

• Google Workspace. Contact and support email is provided by Google and may be processed in the United States under Google’s transfer safeguards.
• Brevo. Waitlist data is processed by Brevo (France). Any transfer outside the EEA is made under an appropriate safeguard.
• Vercel. The website is hosted by Vercel, a US company. Any transfer outside the EEA is made under an appropriate safeguard.

We keep these safeguards under review and will update this section if our providers or their processing locations change.

We keep personal data only as long as needed for the purposes described in this policy, or as required by law. Our retention periods are:

• Waitlist email addresses. Retained until you unsubscribe, withdraw your consent, or the pre-launch campaign ends.
• After the campaign ends. We will review the waitlist data and delete what is no longer necessary within 90 days.
• Unsubscribed contacts. We retain only the minimal suppression information necessary to prevent unwanted marketing.
• Consent records. Retained for as long as reasonably necessary to demonstrate compliance and to respond to relevant complaints or claims.
• Technical logs. Retained according to the retention settings of the hosting provider.
• Support correspondence. Retained for 12 months after the request is resolved, unless a longer period is justified.

Where a legal hold or a legal obligation applies, we retain the relevant data for the period the obligation requires, and no longer.

We use technical and organizational measures to protect personal data. The main ones, as implemented for this website, are:

• Encrypted connections (TLS) for all traffic to the site.
• The Brevo API credential is stored only in server side environment configuration and is never exposed to the browser.
• Input validation on the waitlist form, including email format checks and length limits.
• Rate limiting and bot detection on the waitlist endpoint.
• No third party scripts on the site, which limits where data can leave.
• Access to the website, the Brevo account, and the hosting account is restricted to the operator.

We work to keep your data safe, but no system is completely secure. We cannot guarantee absolute protection against every risk, including unauthorized access or transmission errors.

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data;
• restrict how we process your data in certain cases;
• object to processing based on legitimate interest; and
• receive the data you provided (such as your waitlist details) in a structured, commonly used format where applicable.

Where we process data on the basis of your consent, you can withdraw that consent at any time, for example through the unsubscribe link in a marketing email.

To exercise any of these rights, write to general@labvitro.com. We will respond within one month. We may need longer for complex or numerous requests, and we will tell you if that applies.

If you believe we are not handling your data correctly, you have the right to lodge a complaint with a supervisory authority. For people in the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also contact the authority in your country of residence.

We may update this policy as the product, the law, or our practices change. Material changes will be communicated by email to waitlist subscribers where possible, and by a prominent notice on the website. The “Last updated” date below will be refreshed.

Where a change affects processing that relied on your consent, we will ask for fresh consent where required.

For questions about this policy, or to exercise your rights, contact:

• Intended business name: Van der Valk Interactive (not registered)
• Country: Netherlands
• Privacy contact: general@labvitro.com
• Website: labvitro.com

Last updated: 28 October 2026. Effective date: 28 October 2026