Clouz GmbH Privacy Policy.

Last updated: 27 September 2026.

Clouz GmbH ("Clouz", "we", "us", or "our") takes the protection of personal data seriously. This Privacy Policy explains how we process personal data when you visit our website, use our contact form, or request a OneKnot sample.

This policy is intended to meet the requirements of the EU General Data Protection Regulation ("GDPR") and applicable German data-protection law.

1. Controller

The controller responsible for processing your personal data is:

Clouz GmbH
Schinkestr. 9
12047 Berlin
Germany

Email: info@clouz.one

2. Website hosting and access data

Our website is hosted and technically provided through Squarespace.

When you visit our website, Squarespace processes certain technical information that is necessary to make the website available, secure, and functional. This may include:

—Information about your browser, network, and device
—Your IP address
—The web pages you visited before arriving at our website
—The pages you view on our website
—Technical access, usage, and security information

We process this information to provide the website, maintain its security and stability, prevent misuse, investigate technical faults, and ensure its reliable operation.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, technically reliable, and effective operation of our website.

Squarespace also requires certain visitor data to operate, protect, and improve its platform and services. Further information on Squarespace’s processing of personal data is available in Squarespace’s own privacy information.

Access and technical log data are generally retained for six months and then deleted, unless longer storage is necessary to investigate a security incident or to establish, exercise, or defend legal claims.

3. Contact form and OneKnot sample requests

You may contact us through the contact form on our website and request a OneKnot sample.

When you use the contact form, we process the information you provide, including:

—Your name
—Your email address
—Clinic name
—Department
—Clinic address
—Your indication that you would like to receive a OneKnot sample
—Any additional information you include in your message, if applicable

We process this information to receive, administer, assess, and respond to your request for a OneKnot sample; to communicate with you about that request; and, where relevant, to initiate or manage a professional or commercial relationship with your clinic or organisation.

The legal basis for this processing is:

—Art. 6(1)(b) GDPR, where your request concerns steps taken prior to entering into a contractual or commercial relationship; and/or
—Art. 6(1)(f) GDPR, where processing is necessary for our legitimate interest in responding to professional enquiries, managing sample requests, and developing relationships with potential clinical and commercial partners.

Where you provide the contact details of a clinic or other organisation, we use these details solely for the purposes described above and in accordance with applicable law.

Our contact form is technically provided through Squarespace. Information submitted through the form is provided to Squarespace so that it can provide website-hosting and form-management services to us.

We generally retain contact-form submissions for six months after the final resolution of your enquiry. We may retain data for longer where necessary to manage an ongoing relationship, meet legal or regulatory obligations, or establish, exercise, or defend legal claims.

Please do not submit patient data, health data, or other sensitive personal data through the contact form unless we have specifically requested it through an appropriate secure channel.

4. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small text files or pieces of information stored on, or accessed from, your device when you visit a website.

We use the following categories of cookies and similar technologies:

—Necessary cookies: These are required for Squarespace to securely provide the website and its core technical functions. They cannot be disabled through our cookie settings because the website may not function properly without them.
—Analytics and performance cookies: These help us understand website traffic, visitor activity, and the performance of our website. They are used only if you give your consent through our cookie banner.

Where technically necessary cookies or comparable technologies are used, the legal basis for associated personal-data processing is Art. 6(1)(f) GDPR. Our legitimate interest is the technically secure and functional provision of our website. Where applicable, access to or storage of information on your device is based on the exception for strictly necessary technologies under § 25(2) German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG)

Analytics and performance cookies, and associated access to information on your device, are used only with your prior consent. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR.

You may give, refuse, or withdraw your consent at any time with effect for the future through the cookie settings available on our website. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5. Squarespace Analytics

Subject to your consent, we use Squarespace Analytics to understand how visitors use our website and to improve its content, functionality, performance, and usability.

The information processed through Squarespace Analytics may include:

—Information about your browser, network, and device
—Your IP address
—The web pages you visited before visiting our website
—Pages viewed on our website
—Clicks and internal links
—Scrolling activity
—Searches performed on the website
—Timestamps and related usage information

We provide this information to Squarespace as our website analytics provider. Squarespace uses this information to provide analytics functionality and associated services to us.

The legal basis for this processing is your consent under Art. 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG.

Analytics data are retained for 12 months, after which they are deleted or anonymised in accordance with the applicable technical configuration and provider practices.

6. Recipients of personal data

We disclose personal data only where necessary for the purposes described in this Privacy Policy, where we are legally required to do so, or where you have consented to disclosure.

Squarespace is the principal service provider used in connection with this website. Squarespace provides website-hosting, contact-form, cookie-management, and analytics functionality. Where Squarespace processes personal data that Clouz controls, including information submitted through the contact form, Squarespace acts on our behalf as a processor in accordance with its Data Processing Addendum.

Squarespace may also process certain automatically collected technical and usage information as an independent controller for its own purposes, including maintaining the security, integrity, and operation of its services. This may include information collected when you visit a Squarespace-hosted website, such as IP address and other site-usage information. Further information is available in Squarespace’s Privacy Policy.

Access to relevant personal data within Clouz is limited to authorised personnel who require it to perform their professional duties, including the handling of sample requests and professional enquiries, website administration, information security, legal matters, and compliance.

We do not currently use third-party plugins, embedded content, advertising pixels, social-media tracking tools, or external newsletter providers on this website.

7. International data transfers

Squarespace may process personal data in countries outside the European Economic Area ("EEA"), including the United States and countries in which Squarespace or its subprocessors operate.

For transfers of personal data from the EEA to Squarespace, Inc. in the United States, Squarespace states that it participates in and relies on the EU–US Data Privacy Framework, where applicable.

Where a transfer is not covered by an adequacy decision or the EU‚ÄìUS Data Privacy Framework, Squarespace’s Data Processing Addendum provides for appropriate transfer safeguards. These include the European Commission‚Äôs Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 and, where relevant, supplementary measures. Squarespace states that transfers to subprocessors in countries without an adequate level of protection are made using the processor-to-processor Standard Contractual Clauses or another lawful transfer mechanism.

You may request further information about the applicable transfer safeguards by contacting us using the contact details set out in Section 1.

8. Storage and deletion

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable law.

Unless a longer period is required or justified:

—Website access and technical log data are generally retained for six months.
—Contact-form and OneKnot sample-request data are generally retained for six months after final resolution of the request.
—Squarespace Analytics data are retained for 12 months.
—Cookie-consent records are retained for as long as necessary to demonstrate compliance with consent requirements and to address any related legal claims.

We may retain personal data longer where this is necessary to comply with legal obligations, protect our rights, or establish, exercise, or defend legal claims.

9. Your rights

Subject to the conditions and limitations set out in applicable law, you have the right to:

—Request access to your personal data under Art. 15 GDPR
—Request correction of inaccurate or incomplete personal data under Art. 16 GDPR
—Request deletion of your personal data under Art. 17 GDPR
—Request restriction of processing under Art. 18 GDPR
—Receive personal data that you have provided to us in a structured, commonly used, and machine-readable format, or request transmission to another controller, under Art. 20 GDPR
—Object to processing based on Art. 6(1)(e) or Art. 6(1)(f) GDPR under Art. 21 GDPR
—Withdraw consent at any time with effect for the future, where processing is based on consent

To exercise your rights, please contact us using the contact details in Section 1.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.

For Clouz GmbH, the competent supervisory authority is generally:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
Website: https://www.datenschutz-berlin.de

You may also lodge a complaint with the supervisory authority in your habitual residence, place of work, or the place of the alleged infringement.

11. Changes to this Privacy Policy

We may update this Privacy Policy where changes in our website, processing activities, service providers, or applicable law make this necessary. The current version will always be published on this website.