Privacy
Updated: 7 October 2026
Controller
CoreLayerLabs e.U., owner Florian Balaj, Liselotte-Schmidinger-Straße 9/6, 4600 Wels, Austria. Contact us at info@corelayerlabs.com with questions about your data.
Your enquiry
The form requires your name, email address and project description. Company, budget, phone number and your current website address are optional. Forms for specific services also submit the requested project type. We use these details to respond and discuss a potential project. Article 6(1)(b) GDPR applies to pre-contractual enquiries; other correspondence is processed under Article 6(1)(f), based on our legitimate interest in answering your enquiry.
Applications
When applying on our careers page, we process your selected role, name, email address, message and optional portfolio links or PDF documents to assess and handle your application. Resend sends these to Florian Balaj in our Google Workspace mailbox. Files are not published or additionally stored in a website database. Please do not submit unnecessary special categories of personal data. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps. We review deletion when the procedure concludes; protecting legal claims may justify longer retention. This form does not add you to an applicant pool.
Storage and email
Enquiries are sent directly to our mailbox through Resend. They are not additionally stored in a website database. Resend sends an acknowledgement to your email address and enquiry notifications to us containing the submitted contact details and project description. Our mailbox uses Google Workspace. The form does not subscribe you to a newsletter or share your information with advertising partners.
Hosting and security
Vercel hosts this website. Technical information such as IP address, request time, requested URL and browser information may be processed to provide and protect the website. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure, reliable operation. To limit repeated submissions, we retain short-lived, pseudonymous identifiers derived from the email and IP address within each server instance for up to 15 minutes. A random request identifier prevents duplicate emails within the sending retry window.
Optional visitor statistics
Vercel Web Analytics loads only with your permission. It aggregates information such as pages visited, referral source, time, browser and device. It does not use analytics cookies. Form contents are not sent as analytics events, and query parameters and fragments are removed from analytics URLs. The legal basis is your consent under Article 6(1)(a) GDPR. You can reject analytics or withdraw permission for future processing through Cookie settings in the footer. Withdrawal does not affect the lawfulness of processing before withdrawal.
Microsoft Clarity
With your consent, we use Microsoft Clarity, provided by Microsoft Corporation, for heatmaps and session replays. Data processed includes page URLs, clicks, scrolling, technical device and browser information and IP addresses. Analytics cookies associate page views with sessions. Contact and application forms and their contents are masked; we do not send names, email addresses or project descriptions as custom identifiers. Advertising storage is denied through the consent API. The legal basis is your consent under Article 6(1)(a) GDPR. We do not load Clarity without consent. You can withdraw consent through Cookie settings; the page then reloads to end recording. Recordings are generally retained for 30 days; selected or labeled recordings and aggregated data may remain available for up to 9 months. Microsoft also processes data in the United States under its privacy statement linked below.
Service providers and international processing
Vercel, Resend, Microsoft and Google may process information outside the European Economic Area. Processing is subject to data processing agreements and applicable safeguards for international transfers, including adequacy decisions or standard contractual clauses. See the linked provider privacy information below.
Retention
We keep enquiries while needed to respond and continue the correspondence. We review deletion after the enquiry is concluded. Statutory retention requirements and the protection of legal claims may justify longer retention. Your visitor-statistics choice is considered in local browser storage for up to 180 days.
Your rights
Subject to GDPR requirements, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent for future processing and complain to the Austrian data protection authority or another competent supervisory authority.