Privacy Policy

Privacy Policy — TheLabRoad

Last updated: 29 May 2026
Version: 1.0

1. Who We Are (Data Controller)

TheLabRoad
PANAGIOTIS KARAVELAS — TheLabRoad
Perikleous 0, Ermoupolis, Syros, Greece 84100
Website: https://thelabroad.com
Email: info@thelabroad.com
Phone: +30 22811 20198

TheLabRoad is the data controller for all personal data described in this policy. This means we determine the purposes and means of processing your personal data.

We are established in Greece, a member state of the European Union. All processing described in this policy is subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019 implementing the GDPR at national level.

2. What This Policy Covers

This policy describes how TheLabRoad collects, uses, stores, and protects personal data obtained through:

This policy does not cover third-party websites linked from our site.

3. Personal Data We Collect

3.1 Data You Provide Through the Chat Widget

When you register to use our AI assistant, we collect your first name and last name (to personalise responses and correspondence), your email address (to send quote confirmations, follow-ups, and service communications), your institution or company name (to understand your research context and tailor our assistance), your country (to apply correct pricing, logistics, and compliance information), the content of your chat conversations (to provide accurate technical responses and maintain a record of your inquiry), and the products discussed and any quote requests (to prepare formal quotations and track our sales pipeline).

Legal basis: Article 6(1)(b) GDPR — processing is necessary for the performance of a contract or pre-contractual steps at your request. By registering and using the chat assistant, you are taking steps toward obtaining scientific equipment or technical information from us. The retention of your conversation history, contact details, and sales pipeline records is necessary for the same purpose: to prepare quotations, manage your inquiry, and provide continuity of service. We do not rely on consent for this processing.

3.2 Data Collected Automatically During Chat Sessions

During a chat session we automatically record conversation timestamps (for service records and response time analysis), the number of messages exchanged (for service quality monitoring), whether a quote was requested (for sales pipeline tracking), and the conversation status such as active, ended, or handed to a human (for operational monitoring).

Legal basis: Article 6(1)(b) and Article 6(1)(f) GDPR — legitimate interest in operating and improving our service.

3.3 Data Collected Through Email Campaigns

If you receive email communications from TheLabRoad, we collect email delivery status (to ensure emails reach you), unsubscribe actions (to honour opt-out requests immediately), and data deletion requests (to honour erasure requests immediately).

Legal basis: Article 6(1)(f) GDPR — legitimate interest in conducting relevant business communication with professionals whose work may benefit from our scientific equipment. See Section 5 for full details on legitimate interest.

3.4 Data Obtained From Public Professional Sources

For professional outreach purposes, we may hold contact information for researchers and laboratory professionals sourced from publicly accessible institutional directories, university websites, and company websites. The data collected includes name, professional email address, institution and department, and research area — all sourced from public institutional websites or directories.

Legal basis: Article 6(1)(f) GDPR — legitimate interest. See Section 5 for the full assessment.

Your right to object: You have an unconditional right to object to this processing at any time. See Section 9.

4. How We Use Your Personal Data

4.1 Providing the AI Chat Service

We use your name, institution, country, and conversation history to deliver accurate, personalised technical responses about scientific equipment. This includes routing your inquiry to a human sales representative when the AI assistant cannot confidently answer your question.

4.2 Preparing and Sending Quotations

When you request a price or quotation, we use your contact details and the products discussed to prepare a formal quotation and send it by email. We notify our technical team to follow up.

4.3 Lead Management and Sales Pipeline

We maintain a record of your status in our sales pipeline to manage follow-up communications appropriately and ensure continuity of service.

4.4 Automated Email Follow-Up Sequences

We send structured email sequences related to your inquiry or relationship with TheLabRoad. These sequences are relevant to your professional context — for example, technical follow-ups after a product inquiry, logistics information after a quote, or support information after a purchase.

4.5 Professional Outreach to Researchers

We conduct targeted outreach to researchers and laboratory professionals whose work may benefit from the scientific equipment we distribute. This outreach is limited to professional and institutional email addresses, is directly relevant to the recipient’s professional role, and includes a clear explanation of how we obtained the contact.

4.6 Service Improvement and Analytics

We analyse aggregated, anonymised data about how our chat service is used to improve response quality and identify gaps in our product knowledge base. This analysis does not involve profiling individual users. On a weekly basis, we generate an internal performance summary — including counts of new visitors, quote requests, and campaign engagement — which is sent to the company owner for business monitoring purposes. This summary contains no personal data.

4.7 Legal and Compliance Obligations

We retain certain records as required by Greek commercial law, tax law, and EU regulatory obligations.

4.8 Automated Processing — Article 22 Statement

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. Our AI assistant provides informational responses only. All decisions regarding quotations, orders, and customer relationships are made exclusively by TheLabRoad staff.

5. Legitimate Interest Assessment Summary

Where we rely on Article 6(1)(f) GDPR (legitimate interest), we have conducted a Legitimate Interest Assessment. A summary is provided here; the full assessment is available on request.

5.1 For Cold Professional Outreach

Purpose: To inform researchers and laboratory professionals at EU institutions about scientific equipment relevant to their work.

Interest identified: TheLabRoad has a legitimate commercial interest in reaching professionals who are likely to benefit from our products, in the context of our core business as a scientific equipment distributor.

Necessity: Email is the standard and proportionate channel for B2B professional communication in the scientific equipment sector. We limit contact to institutional and professional email addresses only, and exclude personal email addresses such as Gmail or Hotmail.

Balancing test: The individuals contacted are professionals acting in their professional capacity. The communication is directly relevant to their work. The impact on their privacy is minimal. We disclose in the first contact exactly how we obtained their information. We provide a clear and immediate opt-out mechanism in every email and honour all unsubscribe and deletion requests immediately and permanently.

Conclusion: Legitimate interest is not overridden by individual rights given the professional relevance, the transparency of disclosure, and the robust opt-out mechanism.

Your right to object: You may object to processing under legitimate interest at any time by emailing info@thelabroad.com or by clicking unsubscribe or “delete my data” in any email. We will cease processing immediately with no conditions or justification required from you.

6. Data Retention

We retain personal data only as long as necessary for the purposes described above or as required by law.

Chat visitor profiles are retained for 3 years from last interaction, based on our legitimate interest in maintaining business records. Conversation transcripts are retained for 3 years from the conversation date for business records and quotation reference purposes. Quote requests are retained for 5 years as required by Greek commercial law. Email campaign logs are retained for 2 years from the last send as proof of opt-out compliance. Cold contact records are retained until an opt-out or deletion request is received, or for 2 years without qualifying activity, whichever comes first. For the purposes of this policy, “qualifying activity” means any reply to a TheLabRoad email, any click on a link in a TheLabRoad email, or any interaction with the TheLabRoad chat widget. Activity logs are retained on a 1-year rolling basis for operational monitoring.

When a retention period expires, data is either deleted or irreversibly anonymised.

7. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share data only with the following categories of recipients.

7.1 Data Processors (Sub-Processors)

We use the following third-party processors to operate our service. Each is bound by a Data Processing Agreement and processes data only on our documented instructions.

Mistral AI SAS powers the AI language model behind our chat assistant and processes conversation content. Mistral AI is based in France and all processing remains within the EU — no international data transfer takes place.

Resend Inc. is our email delivery service and sends all transactional and campaign emails on our behalf. Resend is based in the USA. Data transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission under Decision 2021/914, and additionally by the EU-US Data Privacy Framework where applicable. In the event the EU-US Data Privacy Framework is suspended or invalidated, the SCCs remain in force as the primary and independent transfer safeguard. No personal data is transferred to Resend beyond what is strictly necessary to deliver the relevant email.

Railway Corporation provides cloud hosting for our application and database. Our servers are located in Amsterdam, Netherlands, within the EU — no international data transfer takes place.

All personal data processed by our application and stored in our database resides on servers located in Amsterdam, Netherlands, within the European Economic Area.

7.2 Legal Authorities

Where required by applicable law, court order, or regulatory request, we may disclose data to competent authorities. We will notify you where legally permitted before doing so.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the Hellenic Data Protection Authority (HDPA) within 72 hours and notify affected individuals without undue delay, as required by Articles 33 and 34 GDPR.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights. All requests should be directed to info@thelabroad.com. We will respond within 30 days (extendable to 90 days for complex requests, with notice to you).

Article 15 — Right of Access

You have the right to obtain confirmation of whether we process your personal data, and if so, access to that data and information about how it is processed.

Article 16 — Right to Rectification

You have the right to have inaccurate personal data corrected and incomplete personal data completed.

Article 17 — Right to Erasure (“Right to Be Forgotten”)

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and there is no other legal basis, where you object to processing and there are no overriding legitimate grounds, where the data has been unlawfully processed, or where deletion is required by EU or Greek law.

We will action erasure requests immediately when submitted via the “Delete all my data” link in any email. For requests submitted by email, we will action within 30 days. Some data may be retained where required by law, such as accounting records retained under Greek commercial law. Once deleted, your email address is permanently added to our suppression list — it cannot be re-imported or contacted again.

To request deletion of all your data, click “Delete all my data” in any email communication from us, or email info@thelabroad.com with the subject “Data Deletion Request” and the email address associated with your records.

Article 18 — Right to Restriction of Processing

You have the right to request that we restrict processing of your data in certain circumstances — for example, while you contest the accuracy of the data or while we assess an objection you have raised.

Article 20 — Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Article 21 — Right to Object

You have an unconditional right to object at any time to processing based on legitimate interest (Article 6(1)(f)). Upon receiving your objection, we will cease processing for those purposes immediately.

To exercise your right to object to marketing, click “Unsubscribe” or “Delete all my data” in any email, or email info@thelabroad.com.

Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority in your EU member state. In Greece, this is:

Hellenic Data Protection Authority (HDPA)
Kifissias 1-3, 115 23 Athens, Greece
Tel: +30 210 647 5600
Web: https://www.dpa.gr
Email: contact@dpa.gr

10. Cookies and Local Storage

The TheLabRoad chat widget stores your registration details (name, institution, email, country) in your browser’s local storage after your first visit. This allows the registration form to be pre-filled on your return, saving you time. This data is stored only on your own device and is not transmitted to our servers until you actively start a new chat session.

The registration details stored in your browser’s local storage (name, institution, email, country) serve a functional purpose in pre-filling the registration form on return visits. We rely on the functional storage exemption under the ePrivacy Directive and Greek Law 3471/2006 on the basis that this storage is limited strictly to operational continuity of the service you have requested. No data is transmitted to our servers until you actively initiate a new chat session. You may clear this data at any time by clearing your browser’s local storage or site data for thelabroad.com. We have reviewed this use against the Greek Law 3471/2006 functional necessity threshold and consider it compliant; however, if you prefer not to use local storage, clearing your browser site data for thelabroad.com will remove it without affecting your ability to use the service.

This website does not use Google Analytics or any third-party behavioural tracking or advertising cookies. Our website is built on WordPress with Elementor, which sets a strictly necessary session cookie to support emoji rendering. Google reCAPTCHA is used to protect forms and the chat widget from automated abuse and sets two strictly necessary session cookies (rc::a and rc::c) on the google.com domain. None of these cookies track personal behaviour, persist beyond the session where noted, or require consent under the ePrivacy Directive or Greek Law 3471/2006.

11. Children’s Data

Our service is directed at professionals and researchers in the scientific and academic community. We do not knowingly collect personal data from individuals under 16 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately at info@thelabroad.com.

12. Changes to This Policy

We may update this policy periodically to reflect changes in our processing activities, legal obligations, or best practices. We will update the version number and date at the top of this document and notify active users by email of any material changes at least 30 days before those changes take effect.

Where a material change affects processing based on your consent, we will notify you in advance and request your renewed consent before the change takes effect. Continued use alone does not constitute consent.

Where a material change affects processing based on legitimate interest or contract, we will notify you at least 30 days in advance. Continued use of our service after that notification period constitutes acknowledgement of the updated policy.

Previous versions of this policy are available on request. A version changelog is maintained internally and provided to any user or supervisory authority upon request.

13. Contact and Data Requests

For all data protection enquiries, rights requests, and complaints:

TheLabRoad
Email: info@thelabroad.com
Subject line: “Data Protection Request”
Phone: +30 22811 20198

We do not have a mandatory Data Protection Officer (DPO) under Article 37 GDPR, as we do not conduct large-scale systematic monitoring of individuals or process special category data at scale. All data protection matters are handled personally by the company owner.

TheLabRoad maintains a Record of Processing Activities (ROPA) as required by Article 30 GDPR, documenting all processing activities, their purposes, legal bases, data categories, retention periods, and sub-processors. This record is available to the Hellenic Data Protection Authority upon request.

TheLabRoad has conducted a screening assessment under Article 35 GDPR in relation to the AI chat assistant, which processes personal data using a third-party large language model (Mistral AI SAS). Based on that assessment, we have determined that a full Data Protection Impact Assessment is warranted given the use of new technology and the systematic processing of professional inquiry data. The DPIA has been conducted, is maintained internally, and is available to the supervisory authority upon request.

This Privacy Policy was prepared in compliance with the General Data Protection Regulation (EU) 2016/679, the ePrivacy Directive 2002/58/EC as implemented by Greek Law 3471/2006, and Greek Law 4624/2019 implementing the GDPR in Greece.

Last updated: 27 May 2026
Version: 1.1

1. Who We Are (Data Controller)

TheLabRoad
PANAGIOTIS KARAVELAS — TheLabRoad
Perikleous 0, Ermoupolis, Syros, Greece 84100
Website: https://thelabroad.com
Email: info@thelabroad.com
Phone: +30 22811 20198

TheLabRoad is the data controller for all personal data described in this policy. This means we determine the purposes and means of processing your personal data.

We are established in Greece, a member state of the European Union. All processing described in this policy is subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019 implementing the GDPR at national level.

2. What This Policy Covers

This policy describes how TheLabRoad collects, uses, stores, and protects personal data obtained through:

This policy does not cover third-party websites linked from our site.

3. Personal Data We Collect

3.1 Data You Provide Through the Chat Widget

When you register to use our AI assistant, we collect your first name and last name (to personalise responses and correspondence), your email address (to send quote confirmations, follow-ups, and service communications), your institution or company name (to understand your research context and tailor our assistance), your country (to apply correct pricing, logistics, and compliance information), the content of your chat conversations (to provide accurate technical responses and maintain a record of your inquiry), and the products discussed and any quote requests (to prepare formal quotations and track our sales pipeline).

Legal basis: Article 6(1)(b) GDPR — processing is necessary for the performance of a contract or pre-contractual steps at your request. By registering and using the chat assistant, you are taking steps toward obtaining scientific equipment or technical information from us. We also rely on Article 6(1)(a) — consent — as evidenced by your explicit agreement to data processing shown at the point of registration.

3.2 Data Collected Automatically During Chat Sessions

During a chat session we automatically record conversation timestamps (for service records and response time analysis), the number of messages exchanged (for service quality monitoring), whether a quote was requested (for sales pipeline tracking), and the conversation status such as active, ended, or handed to a human (for operational monitoring).

Legal basis: Article 6(1)(b) and Article 6(1)(f) GDPR — legitimate interest in operating and improving our service.

3.3 Data Collected Through Email Campaigns

If you receive email communications from TheLabRoad, we collect email delivery status (to ensure emails reach you), unsubscribe actions (to honour opt-out requests immediately), and data deletion requests (to honour erasure requests immediately).

Legal basis: Article 6(1)(f) GDPR — legitimate interest in conducting relevant business communication with professionals whose work may benefit from our scientific equipment. See Section 5 for full details on legitimate interest.

3.4 Data Obtained From Public Professional Sources

For professional outreach purposes, we may hold contact information for researchers and laboratory professionals sourced from publicly accessible institutional directories, university websites, and company websites. The data collected includes name, professional email address, institution and department, and research area — all sourced from public institutional websites or directories.

Legal basis: Article 6(1)(f) GDPR — legitimate interest. See Section 5 for the full assessment.

Your right to object: You have an unconditional right to object to this processing at any time. See Section 9.

4. How We Use Your Personal Data

4.1 Providing the AI Chat Service

We use your name, institution, country, and conversation history to deliver accurate, personalised technical responses about scientific equipment. This includes routing your inquiry to a human sales representative when the AI assistant cannot confidently answer your question.

4.2 Preparing and Sending Quotations

When you request a price or quotation, we use your contact details and the products discussed to prepare a formal quotation and send it by email. We notify our technical team to follow up.

4.3 Lead Management and Sales Pipeline

We maintain a record of your status in our sales pipeline to manage follow-up communications appropriately and ensure continuity of service.

4.4 Automated Email Follow-Up Sequences

We send structured email sequences related to your inquiry or relationship with TheLabRoad. These sequences are relevant to your professional context — for example, technical follow-ups after a product inquiry, logistics information after a quote, or support information after a purchase.

4.5 Professional Outreach to Researchers

We conduct targeted outreach to researchers and laboratory professionals whose work may benefit from the scientific equipment we distribute. This outreach is limited to professional and institutional email addresses, is directly relevant to the recipient’s professional role, and includes a clear explanation of how we obtained the contact.

4.6 Service Improvement and Analytics

We analyse aggregated, anonymised data about how our chat service is used to improve response quality and identify gaps in our product knowledge base. This analysis does not involve profiling individual users.

4.7 Legal and Compliance Obligations

We retain certain records as required by Greek commercial law, tax law, and EU regulatory obligations.

4.8 Automated Processing — Article 22 Statement

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. Our AI assistant provides informational responses only. All decisions regarding quotations, orders, and customer relationships are made exclusively by TheLabRoad staff.

5. Legitimate Interest Assessment Summary

Where we rely on Article 6(1)(f) GDPR (legitimate interest), we have conducted a Legitimate Interest Assessment. A summary is provided here; the full assessment is available on request.

5.1 For Cold Professional Outreach

Purpose: To inform researchers and laboratory professionals at EU institutions about scientific equipment relevant to their work.

Interest identified: TheLabRoad has a legitimate commercial interest in reaching professionals who are likely to benefit from our products, in the context of our core business as a scientific equipment distributor.

Necessity: Email is the standard and proportionate channel for B2B professional communication in the scientific equipment sector. We limit contact to institutional and professional email addresses only, and exclude personal email addresses such as Gmail or Hotmail.

Balancing test: The individuals contacted are professionals acting in their professional capacity. The communication is directly relevant to their work. The impact on their privacy is minimal. We disclose in the first contact exactly how we obtained their information. We provide a clear and immediate opt-out mechanism in every email and honour all unsubscribe and deletion requests immediately and permanently.

Conclusion: Legitimate interest is not overridden by individual rights given the professional relevance, the transparency of disclosure, and the robust opt-out mechanism.

Your right to object: You may object to processing under legitimate interest at any time by emailing info@thelabroad.com or by clicking unsubscribe or “delete my data” in any email. We will cease processing immediately with no conditions or justification required from you.

6. Data Retention

We retain personal data only as long as necessary for the purposes described above or as required by law.

Chat visitor profiles are retained for 3 years from last interaction, based on our legitimate interest in maintaining business records. Conversation transcripts are retained for 3 years from the conversation date for business records and quotation reference purposes. Quote requests are retained for 5 years as required by Greek commercial law. Email campaign logs are retained for 2 years from the last send as proof of opt-out compliance. Cold contact records are retained until an opt-out or deletion request is received, or for 2 years of inactivity, whichever comes first. Activity logs are retained on a 1-year rolling basis for operational monitoring.

When a retention period expires, data is either deleted or irreversibly anonymised.

7. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share data only with the following categories of recipients.

7.1 Data Processors (Sub-Processors)

We use the following third-party processors to operate our service. Each is bound by a Data Processing Agreement and processes data only on our documented instructions.

Mistral AI SAS powers the AI language model behind our chat assistant and processes conversation content. Mistral AI is based in France and all processing remains within the EU — no international data transfer takes place.

Resend Inc. is our email delivery service and sends all transactional and campaign emails on our behalf. Resend is based in the USA. Data transfers are governed by EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

Railway Corporation provides cloud hosting for our application and database. Our servers are located in Amsterdam, Netherlands, within the EU — no international data transfer takes place.

All personal data processed by our application and stored in our database resides on servers located in Amsterdam, Netherlands, within the European Economic Area.

7.2 Legal Authorities

Where required by applicable law, court order, or regulatory request, we may disclose data to competent authorities. We will notify you where legally permitted before doing so.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the Hellenic Data Protection Authority (HDPA) within 72 hours and notify affected individuals without undue delay, as required by Articles 33 and 34 GDPR.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights. All requests should be directed to info@thelabroad.com. We will respond within 30 days (extendable to 90 days for complex requests, with notice to you).

Article 15 — Right of Access

You have the right to obtain confirmation of whether we process your personal data, and if so, access to that data and information about how it is processed.

Article 16 — Right to Rectification

You have the right to have inaccurate personal data corrected and incomplete personal data completed.

Article 17 — Right to Erasure (“Right to Be Forgotten”)

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and there is no other legal basis, where you object to processing and there are no overriding legitimate grounds, where the data has been unlawfully processed, or where deletion is required by EU or Greek law.

We will action erasure requests within 30 days. Some data may be retained where required by law, such as accounting records retained under Greek commercial law.

To request deletion of all your data, email info@thelabroad.com with the subject “Data Deletion Request” and the email address associated with your records. You may also click “Delete all my data” in any email communication from us.

Article 18 — Right to Restriction of Processing

You have the right to request that we restrict processing of your data in certain circumstances — for example, while you contest the accuracy of the data or while we assess an objection you have raised.

Article 20 — Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Article 21 — Right to Object

You have an unconditional right to object at any time to processing based on legitimate interest (Article 6(1)(f)). Upon receiving your objection, we will cease processing for those purposes immediately.

To exercise your right to object to marketing, click “Unsubscribe” or “Delete all my data” in any email, or email info@thelabroad.com.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority in your EU member state. In Greece, this is:

Hellenic Data Protection Authority (HDPA)
Kifissias 1-3, 115 23 Athens, Greece
Tel: +30 210 647 5600
Web: https://www.dpa.gr
Email: contact@dpa.gr

10. Cookies and Local Storage

The TheLabRoad chat widget stores your registration details (name, institution, email, country) in your browser’s local storage after your first visit. This allows the registration form to be pre-filled on your return, saving you time. This data is stored only on your own device and is not transmitted to our servers until you actively start a new chat session.

This is functional storage — it is strictly necessary for the convenience of the service and does not track your behaviour across websites. It does not require consent under the ePrivacy Directive.

You can clear this data at any time by clearing your browser’s local storage or site data for thelabroad.com.

This website does not use Google Analytics or any third-party behavioural tracking or advertising cookies. Our website is built on WordPress with Elementor, which may set a small number of strictly necessary functional cookies to maintain basic website operation. These do not track personal behaviour and do not require consent.

11. Children’s Data

Our service is directed at professionals and researchers in the scientific and academic community. We do not knowingly collect personal data from individuals under 16 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately at info@thelabroad.com.

12. Changes to This Policy

We may update this policy periodically to reflect changes in our processing activities, legal obligations, or best practices. We will update the date at the top of this document, notify active users by email of any material changes, and maintain previous versions for reference upon request.

Continued use of our service after a material change constitutes acceptance of the updated policy.

13. Contact and Data Requests

For all data protection enquiries, rights requests, and complaints:

TheLabRoad
Email: info@thelabroad.com
Subject line: “Data Protection Request”
Phone: +30 22811 20198

We do not have a mandatory Data Protection Officer (DPO) under Article 37 GDPR, as we do not conduct large-scale systematic monitoring of individuals or process special category data at scale. All data protection matters are handled personally by the company owner.

This Privacy Policy was prepared in compliance with the General Data Protection Regulation (EU) 2016/679, the ePrivacy Directive 2002/58/EC as implemented by Greek Law 3471/2006, and Greek Law 4624/2019 implementing the GDPR in Greece.