Privacy policy

This privacy policy explains which personal data are processed when you visit this website, for what purpose and on which legal basis. We process only the data needed to run the website and the features you use. We do not use analytics, marketing or social-media tracking services.

1. Controller

Serotune Biosciences GmbH
represented by Matthias Rother, Managing Director
[street and number]
[postcode and city]
Germany
Email: info@serotune.com

2. Hosting of the website

The website is hosted by Scalingo SAS, 3 place de Haguenau, 67000 Strasbourg, France, in a data centre in France. Whenever a page is requested, Scalingo processes technical access data on our behalf: IP address, date and time of the request, the page requested, referrer URL, browser type and operating system. These data are needed to deliver the website, to keep it stable and secure and to fend off attacks. The legal basis is our legitimate interest in a secure and efficient operation (Art. 6 (1)(f) GDPR). Access logs are deleted after a short period. A data processing agreement is in place with Scalingo (Art. 28 GDPR); the data remain within the European Union.

3. Content management system and images

The content, images and documents of this website as well as the newsletter subscriptions are stored in a content management system operated by us. It runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in the European Union. When images and documents are loaded, this server processes the same technical access data as described in section 2, likewise on the basis of Art. 6 (1)(f) GDPR. A data processing agreement is in place with Hetzner.

4. Fonts and third-party content

The fonts used on this website are served from our own servers; visiting the website does not establish a connection to Google or any other font provider. No third-party content such as videos, maps or social-media elements is embedded.

5. Cookies

This website only sets cookies that are technically necessary for its operation. They are stored without consent (§ 25 (2) no. 2 TDDDG, Art. 6 (1)(f) GDPR).

Cookie	Purpose	Lifetime
locale	stores the language you chose (English or German)	12 months
serotune_consent	stores your decision in the cookie notice, if one is shown	12 months
site-access	access protection while the website is available to a closed group before publication	30 days

You can delete or block cookies at any time in your browser settings; the language is then determined anew on every visit.

6. Consent management

Should we use services in future that require your consent, we will ask you beforehand through a cookie notice. We store your decision in the cookie serotune_consent and record it as an anonymous event (accepted or rejected, with a timestamp) in our content management system so that we can demonstrate consent (Art. 7 (1) GDPR in conjunction with Art. 6 (1)(c) GDPR). Neither your IP address nor any other identifier is stored with it. You can change or withdraw a consent at any time through the link "Cookie settings" in the footer.

7. Newsletter

You can subscribe with your email address to our newsletter with programme updates, regulatory milestones and publications. We use the double opt-in procedure: after subscribing you receive an email with a confirmation link, and only after you have opened it do we add you to the mailing list.

We store your email address, the language you chose, the wording of your consent and the time of the subscription and of the confirmation. The confirmation token is stored only as a checksum and is valid for 48 hours. Your IP address is processed only briefly during the subscription to block automated sign-ups; it is not stored. The confirmation email is sent through [email service provider, to be completed].

The legal basis is your consent (Art. 6 (1)(a) GDPR). You may withdraw it at any time with effect for the future, by email to info@serotune.com or through the unsubscribe link in every issue. After withdrawal we delete your data from the mailing list; unconfirmed subscriptions are deleted regularly.

8. Contact by email

If you write to us by email, we process your address, the details you provide and the content of your message in order to answer your enquiry. The legal basis is Art. 6 (1)(b) GDPR where the enquiry is aimed at a contract, and otherwise our legitimate interest in answering enquiries (Art. 6 (1)(f) GDPR). We delete the message once it is no longer needed and no statutory retention obligation applies.

9. Links to LinkedIn profiles

In the "Team" section we link to the LinkedIn profiles of individual team members. These are plain links; no data are transmitted to LinkedIn when you visit our website. Only when you click a link do you leave our website, and LinkedIn's privacy policy applies from then on.

10. Recipients and processors

We pass on personal data only where this is necessary to run the website: to Scalingo (hosting of the website), to Hetzner (server of the content management system), to the email service provider that sends the confirmation emails, and to the agency we have engaged for the technical maintenance of the website. All service providers are contractually bound to process data only on our instructions (Art. 28 GDPR). Data are not passed on for advertising purposes.

11. Retention

We store personal data only for as long as required for the respective purpose or by statutory retention obligations. The specific periods are stated with the individual processing activities.

12. Your rights

You have the right to obtain information about the data we store about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw a consent you have given at any time with effect for the future (Art. 7 (3) GDPR).

Right to object: where we process data on the basis of a legitimate interest (Art. 6 (1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An email to info@serotune.com is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for instance the state data protection commissioner responsible for our registered office.

13. Data security

The connection to this website is encrypted with TLS. We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

14. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.

Last updated: September 2026

The details in square brackets (address, email service provider) will be completed before publication.