We're hiring Book a call
RBB LAB / Legal

Privacy Policy

How we collect, use, and protect your personal data.

Last updated 13 June 2026

1. Data controller

The data controller for personal data collected through this website is:

RBB LAB
Republic of San Marino
Email: privacy@rbblab.com

This policy applies to the website rbblab.com and covers all personal data collected through the contact form, job application form, and ordinary use of the site.

Processing is carried out in accordance with EU Regulation 2016/679 (GDPR) and the Republic of San Marino Law no. 71 of 23 May 2022 on the protection of personal data.

2. What data we collect and how

Contact form

When you submit an enquiry, we collect:

  • Your name
  • Your email address
  • Company name (optional)
  • Project stage and budget range (optional)
  • The content of your message

Job applications

When you apply for a position, we collect:

  • Your name and email address
  • Your CV (PDF or DOCX, up to 5 MB)
  • A cover note (optional)
  • The role you applied for

Technical data

When you visit this site, Cloudflare (our hosting provider) processes your IP address and standard HTTP request metadata for security and infrastructure purposes. We do not have direct access to this data and do not use it for profiling or analytics.

3. Legal basis for processing

We rely on the following legal bases under Art. 6 GDPR:

  • Legitimate interest (Art. 6(1)(f)): processing contact form submissions to respond to business enquiries. Our legitimate interest is to communicate with potential clients who have reached out to us.
  • Pre-contractual steps (Art. 6(1)(b)): processing job applications to evaluate candidates at their own request.
  • Legitimate interest (Art. 6(1)(f)): processing technical data to ensure the security and correct operation of the website.

4. How we use your data

We use the data we collect exclusively to:

  • Read and respond to your enquiry or application
  • Evaluate your candidacy for open roles
  • Maintain the security and stability of the site

We do not use your data for marketing, profiling, or automated decision-making. We do not sell or rent personal data to any third party.

5. Who we share data with

Your data is processed by the following third-party service providers acting as data processors on our behalf:

  • Cloudflare, Inc. (USA) - website hosting, CDN, and infrastructure. Cloudflare acts as processor under a Data Processing Addendum. Transfers are covered by Standard Contractual Clauses (SCCs).
  • Resend, Inc. (USA) - transactional email delivery. When you submit the contact or application form, your data is transmitted to Resend to deliver the notification to us. Transfers are covered by SCCs.
  • Cloudflare R2 - CV files uploaded through the job application form are stored in Cloudflare R2 object storage for 7 days, then deleted automatically.

We do not share your data with any other parties unless required to do so by law.

6. International transfers

Both Cloudflare and Resend are headquartered in the United States. Transfers to these providers are made under Standard Contractual Clauses adopted by the European Commission, which provide an adequate level of protection consistent with GDPR and San Marino Law 71/2022.

7. Retention periods

  • Contact form submissions: retained for as long as reasonably necessary to manage the business relationship, then deleted.
  • CV files: automatically deleted after 7 days from submission.
  • Job application notifications: retained for up to 6 months, then deleted.
  • Technical data (Cloudflare logs): retained by Cloudflare in accordance with their retention policies, typically no longer than 30 days.

8. Your rights

Under GDPR and San Marino Law 71/2022, you have the following rights:

  • Access (Art. 15 GDPR): request a copy of the personal data we hold about you.
  • Rectification (Art. 16): ask us to correct inaccurate data.
  • Erasure (Art. 17): ask us to delete your data where there is no longer a lawful basis to hold it.
  • Restriction (Art. 18): ask us to restrict processing in certain circumstances.
  • Portability (Art. 20): receive your data in a structured, machine-readable format where processing is based on consent or contract.
  • Object (Art. 21): object at any time to processing based on legitimate interests.

We do not carry out automated decision-making or profiling.

To exercise any of these rights, write to privacy@rbblab.com. We will respond within 30 days. No fee applies unless a request is manifestly unfounded or excessive.

9. Cookies

This website does not use tracking, analytics, or advertising cookies. Cloudflare may set a technically necessary cookie (__cf_bm) for bot protection. This cookie does not track you across sites and is not used for advertising. No consent is required as it is essential for the security of the service.

10. Supervisory authority

If you believe your data is not being handled in accordance with applicable law, you have the right to lodge a complaint with:

Autorita Garante per la protezione dei dati personali
Repubblica di San Marino (GPDP)
www.garanteprivacy.sm

If you are located in an EU member state, you may also contact your local data protection authority.

11. Changes to this policy

We may update this policy to reflect changes in our practices or applicable law. The date at the top of this page shows when it was last revised. Continued use of the site after any changes constitutes acceptance of the updated policy.

12. Contact

For any questions about this policy or how we handle your data, write to privacy@rbblab.com.