Privacy Policy

The LILY Services are directed exclusively at B2B customers, i.e., legal persons or partnerships with legal capacity. Accordingly, personal data processed under this Privacy Policy generally relate to the respective B2B customer’s representatives, contact persons, authorised users and beneficial owners, each acting in a business capacity. As a general rule, We therefore do not process any sensitive data (Art. 9 GDPR) or personal data related to private life/circumstances of the aforementioned data subjects.

For the Beta Terms, please refer to lilylabs.io/legal/terms.

LILY Labs GmbH
Maudacherstraße 45
67065 Ludwigshafen am Rhein
Germany
Email: privacy@lilylabs.io

We process the following categories of personal data in relation to the different processing activities covered by this Privacy Policy:

We generally collect all personal data that We process directly from you when you provide the data to us. To some extent, some of the personal data is also collected automatically when you visit the Website or use the LILY Services.

We process your personal data for the following purposes under each of the different processing activities covered by this Privacy Policy:

When you visit our Website, or access the LILY Services through the Website, your browser transmits certain data to our web server. We process such data to ensure the functionality and security of the Website, including detecting and repelling attacks and ensuring the functionality of the Website.

To access and use the Beta Programme you must register a business account, using the B2B gate. Data provided in the B2B gate is used for authentication and verification purposes to set up your account, validate the VAT-ID provided against the EU VIES system, or, for non-EU users, an equivalent business identifier and verify your status as entrepreneur.

As a key part of the LILY Services, We provide the CLI with integrated compiler and local runtime environment for compiling, locally executing and deploying user applications. CLI enables users to compile their source code by means of the different functionalities offered under the LILY Services. To the extent personal data is processed in this context, processing is carried out for metering of resource consumption for credit-based billing (as further detailed in the Beta Terms).

When you use the Platform, We process certain data to operate, secure, debug and improve the Platform’s core functionality, i.e. to understand which features are used and where errors or friction occur. If you have consented via the CMP to the use of the respective Cookies, We may also use your personal data for marketing, advertising or conversion purposes.

We may collect technical logs and operational telemetry of programs, applications or workload compiled by users of the LILY Services that are executed on LILY’s multi-tenant server infrastructure (Void). Such processing activities are carried out for error and crash analysis, to ensure and maintain operational stability and capacity management, security monitoring and abuse prevention.

We process certain personal data to transact business and maintain a professional relationship with you and/or the company you represent, in particular to send contractually required and operationally necessary emails concerning the services requested, including registration and admission confirmation, billing notices, service notifications, and support emails.

As part of our general business processes, We may process certain personal data to comply with applicable legal obligations, such as tax law requirements, identity verification (KYC) and screening of paying customers, their beneficial owners and relevant counterparties against applicable financial-sanctions and asset-freeze lists. This may include AML checks where applicable (as further detailed in the Beta Terms). We may also process personal data to establish, exercise or defend our legal rights, to comply with lawful government requests for disclosure of personal information or otherwise to comply with legal obligations.

We may process certain personal data to send you emails informing you about product news or beta announcements. If you have signed up for newsletters, We may, in addition, process your data to inform you about the services, offerings, events and newsletters in which you have expressed an interest.

Where We can do so lawfully under applicable law, We may share certain personal data processed by us with the following categories of recipients, some of whom may be located in a country that does not provide an adequate level of data privacy and protection rights as the European Union (“EU”), as necessary for the purposes identified above in section 4 (see section 6.2 for more information). These recipients may have both direct access to your personal data (e.g., if We transfer your personal data) or remote access (e.g., if these recipients access personal data that is stored in our systems).

We rely on the following services providers when processing personal data for the purposes identified in this Privacy Policy. Recipients handle personal data in EU data centres unless otherwise stated; where a recipient processes data in the US or another country that is not considered as providing for an adequate level of data protection under EU law , the transfer basis is stated in the table.

Advisors and authorities: This includes auditors, accounting service providers, lawyers, banks, tax advisors and similar bodies to the extent that sharing your personal data with them is necessary for the provision of their services and/or compliance with legal obligations that We are subject to. We may also be legally obligated to provide information to certain public authorities upon request, such as law enforcement agencies, authorities that prosecute administrative offenses subject to fines and tax authorities.

Payment service providers: We may also share your personal data with payment service providers such as Stripe that may act as independent controllers for payment execution and compliance with their own AML, fraud and/or sanction list screening obligations.

Where a recipient processes data in the US or another country that is not considered as providing for an adequate level of data protection under EU law, residual risks exist due to potential access by local authorities. For the US, We rely on the EU-US Data Privacy Framework to ensure an adequate level of data protection where a recipient is certified. In other cases, We have implemented appropriate safeguards, such as the EU Standard Contractual Clauses, and/or are relying on binding corporate rules of the recipient or an appropriate derogation. Where applicable, We implement supplementary technical and contractual safeguards. In addition to the rights set out in section 8 below, you can request further information on such appropriate safeguards, using the contact details indicated in that section 8.

We process personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. Data subject to statutory commercial or tax retention requirements (in particular Section 257 of the German Commercial Code (Handelsgesetzbuch), Section 147 of the German Fiscal Code (Abgabenordnung)) are retained for the prescribed period (generally 6 to 10 years). Data subject to anti-money-laundering retention (Section 8 of the German Act on Money-Laundering (Geldwäschegesetz)) are generally retained for 5 years, unless longer retention is statutorily required. Data needed to assert, exercise or defend legal claims are generally retained until expiry of the applicable limitation period (generally 3 years). Operational and technical data (such as server logs, telemetry and analytics data) are generally deleted or anonymised within 90 days after collection, unless longer retention is required for security incident investigation or legal proceedings. After the purpose ceases and any retention periods expire, data are deleted or anonymised.

You have the following rights regarding your personal data:

In certain cases, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. If you exercise this right to object, We will no longer process your personal data for these purposes unless We have compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

If We process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where We process your personal data on the basis of consent, you have the right to withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing of your personal data up to the time of withdrawal. For newsletters that you have subscribed for, you can withdraw your consent via the unsubscribe link provided in the newsletter; Cookie consent can be withdrawn via the CMP.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for LILY is: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

You can exercise your rights at any time by contacting us at: privacy@lilylabs.io.

We may update this Privacy Policy from time to time as necessary when processing activities, service providers or legal requirements change. The current version is available at lilylabs.io/legal/privacy. For material changes, registered users will be notified by email.