Legal Documentation & Governance

**Effective Date:** September 1, 2026

**Data Controller:** ProductCraftLab, registered at 63452 Querstraße 12, Hanau, Germany. Contact: [email protected]

## 1.1 Data Collection

ProductCraftLab collects personal information only when voluntarily submitted by users through contact forms, consultation requests, or service inquiries. Data collected includes: full name, email address, phone number, company name, project scope details, and budget parameters.

## 1.2 Purpose of Processing

Personal data is processed exclusively for: (a) responding to project inquiries, (b) delivering contracted design services, (c) sending project-related communications, and (d) maintaining statutory financial records as required by German commercial law (HGB §257).

## 1.3 Legal Basis

Processing is conducted under GDPR Article 6(1)(b) — performance of a contract — and Article 6(1)(f) — legitimate interest in responding to business inquiries. For CCPA-covered users, personal data is not sold, rented, or shared with third parties for commercial purposes.

## 1.4 Data Retention

Contact form submissions are retained for 24 months from the date of submission. Project-related data is retained for the duration of the engagement plus 6 years as required by German tax retention regulations (AO §147). Upon request, all personal data is permanently deleted within 30 days.

## 1.5 Data Security

All personal data is stored within encrypted EU-hosted infrastructure. ProductCraftLab implements industry-standard TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest. Access to personal data is restricted to authorized personnel only.

## 1.6 User Rights

Under GDPR, you have the right to: access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), data portability (Art. 20), and object to processing (Art. 21). To exercise any right, contact [email protected]. Under CCPA, California residents have additional rights including the right to know, delete, and opt out of the sale of personal information.

## 1.7 Third-Party Services

ProductCraftLab uses the following third-party processors: Google Maps (embedded map display only, no API key required), Stripe (payment processing), and standard email infrastructure. No analytics trackers, advertising pixels, or social media widgets are loaded without explicit consent.

## 2.1 Service Scope

ProductCraftLab provides digital product design services including design systems, SaaS prototyping, user research, wireframing, UI kit development, interactive prototyping, design sprints, and accessibility audits. All services are delivered as described in individual project proposals and Statements of Work (SOW).

## 2.2 Intellectual Property

Upon complete payment of all agreed invoices, ProductCraftLab assigns all worldwide intellectual property rights in client-specific deliverables, design tokens, component libraries, and digital assets directly to the Client. ProductCraftLab retains the right to display anonymized portfolio examples unless otherwise agreed in writing.

## 2.3 Payment Terms

All project engagements require a 50% deposit upon SOW signing, with the remaining 50% due upon final delivery and acceptance. Invoices are payable within 14 days. Late payments accrue interest at the statutory rate under German civil law (BGB §288). Payment processing is handled securely through Stripe.

## 2.4 Project Timelines

Delivery timelines specified in proposals are estimates based on the scope defined in the SOW. Material changes to scope, requirements, or feedback turnaround may affect timelines. ProductCraftLab will communicate any timeline adjustments proactively with revised estimates.

## 2.5 Limitation of Liability

ProductCraftLab's total liability for any project engagement shall not exceed the total fees paid by the Client for that specific engagement. ProductCraftLab shall not be liable for indirect, incidental, or consequential damages, including lost profits or business interruption.

## 2.6 Confidentiality

Both parties agree to maintain confidentiality of proprietary information shared during the engagement. This obligation survives termination of the agreement for a period of 24 months.

## 3.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help the site remember your preferences and improve your browsing experience.

## 3.2 Cookies We Use

ProductCraftLab uses only one cookie: cookie_accepted — a functional cookie that stores your consent preference for the cookie banner. This cookie is strictly necessary for the site to remember your choice and is not used for tracking, analytics, or advertising.

## 3.3 No Tracking Cookies

ProductCraftLab does not use Google Analytics, Facebook Pixel, advertising cookies, or any third-party tracking cookies. No behavioral profiling or cross-site tracking is performed.

## 3.4 Managing Cookies

You can control cookies through your browser settings. Disabling the cookie_accepted cookie will simply cause the consent banner to reappear on each visit. No site functionality is affected.

## 4.1 Deposit Refund

If a project is cancelled by the Client before any work has commenced, the 50% deposit is fully refundable within 14 business days. Cancellation must be communicated in writing to [email protected].

## 4.2 Partial Refund

If a project is cancelled after work has commenced, a partial refund is issued proportional to the work completed at the time of cancellation, minus any third-party costs already incurred. The Client receives all deliverables completed up to the cancellation date.

## 4.3 Non-Refundable Items

Completed milestones, delivered design assets, and consultation hours already rendered are non-refundable. Monthly retainer fees are non-refundable once the billing period has begun.

## 4.4 Dispute Resolution

Refund requests are reviewed within 5 business days. If the Client and ProductCraftLab cannot reach an agreement, disputes shall be submitted to the competent court in Hanau, Germany, in accordance with German commercial law.