Privacy notice

The controller responsible for personal data processed through this website and when handling your enquiry is:

Auranex LLC
131 Continental Dr, Suite 305
Newark, DE 19713
United States

The LLC is represented by Raphael Rechberger, who can be reached at raphael@exobasis.com. For privacy questions and requests to exercise your rights, contact legal@exobasis.com directly. This is also the LLC's general public contact address. Further details appear in the Provider information.

This notice covers website visits, initial organisational contact and the associated technical processing. Before you provide personal records for an assignment, you will receive information about the data arrangements agreed for that work.

The short form on Private enquiry is not currently enabled for sending. Its intended data flow is separate from direct email. You can send an email to legal@exobasis.com.

The short form requires an email address we can reply to, an enquiry topic and your preferred reply language. A name or alias and a short message are optional. The form language and, where selected, a public page or service reference are also transmitted. Without an email address we cannot reply through this form route; without a topic the form cannot be submitted. Your message is used to identify and answer your question or prepare an assignment you have requested.

Do not send identity documents, health information, bank statements, asset schedules, passwords or recovery codes through ordinary email or the short form. The form does not accept files. An appropriate protected channel will be agreed for any confidential records needed later.

Once connected, the form service passes these details to the enquiry mailbox configured for EXOBASIS. Your email address is used as the reply address. The enquiry process does not create a separate permanent message database. A submission confirmation means the mail transport has accepted the message; it does not confirm arrival in the destination inbox, book an appointment or establish an assignment.

Purpose and legal basis

Where the EU GDPR or UK GDPR applies, necessary steps towards a contract at your request, and performance of your contract, rely on Article 6(1)(b). General questions and correspondence with a company's contact person are handled under Article 6(1)(f): our legitimate interest is to answer incoming enquiries appropriately and manage business contacts. Contacting us is not blanket consent to marketing or other uses.

Processing covered by the Swiss Federal Act on Data Protection must, in particular, be lawful, in good faith, proportionate and consistent with its purpose. Processing that infringes personality rights requires a justification under Article 31. Where the UAE federal personal data protection law applies, Article 4(9) permits necessary steps towards a contract at your request and performance of that contract. Other purposes require a separate statutory exception or valid consent.

Content pages are delivered as HTML with locally supplied presentation files and interactive features. When a page is requested, the serving infrastructure receives connection data, including the IP address, the requested address and HTTP information sent by the browser. This allows the page to be delivered and technical faults to be identified. The current website does not embed advertising pixels, external CAPTCHA services, session replay or externally loaded fonts. External source links open their destination only when you select them.

The country directory stores your search text, region, selected countries and list-view preference in this tab's session storage so your selection is available when you return. This does not create an account or collect personal case records. The selection is not sent to the enquiry process.

The planned form submission uses two limited status stores. Your browser keeps a random confirmation reference in the current tab's session storage. After the mail transport accepts a message, the server sets a cookie containing a random status token. The cookie is restricted to the confirmation path, cannot be read by page scripts and, in HTTPS operation, uses Secure and SameSite=Strict. It is valid for five minutes. The status records contain a reference, the form language and an expiry time, not your message or email address. The reference stays in the tab's session storage so the status can be checked when you return. The reference alone does not confirm a submission. Closing the tab ends its session storage. An expired confirmation or one without the matching binding remains neutral.

To protect the form against excessive submissions, the server derives a check value from the connection address using a secret process key. Its associated counter is valid for ten minutes. This is pseudonymised data, not proven anonymous data. These counters and confirmation records are held in the enquiry process's working memory. Expired entries are removed on the next request or during regular cleanup; ending the process clears its memory.

Under the EU GDPR and UK GDPR, proportionate security and reliable delivery of the requested function are legitimate interests under Article 6(1)(f). Storing or reading information on your device is also subject to the applicable device-access rules. An exception from consent requires the particular storage to be strictly necessary for a function you expressly request; a general security interest alone does not satisfy that test.

Auranex LLC is the controller identified at the US address above. The installed server infrastructure is operated with Hostinger. Neither the LLC's US address nor the hosting brand determines the country of every individual access or storage operation.

For email correspondence, the mail services used for sending and receiving also process the message and the necessary address and transport data. The planned short form uses a separately connected mail transport. Mailbox storage and possible transport logs are distinct from the enquiry process's short-lived status records.

The short form does not automatically pass your information to CryptPad, SimpleX, a calendar or a customer workspace. Installing a system does not by itself make it an available customer channel. For a separately agreed protected exchange, recipients and access permissions are limited to the particular task. Discretion and protected collaboration explains how first contact is separated from personal case work.

Technical processors act on instructions for the agreed purpose. A specialist acting under their own professional obligations may instead be a controller in their own right. Before information is shared for an assignment, the recipient, the information needed and the purpose of the disclosure must therefore be established.

Where the EU GDPR applies, sharing data with another recipient outside the EEA is also subject to its international transfer rules. This requires, for example, an applicable adequacy decision or appropriate safeguards, such as suitable standard contractual clauses and any supplementary measures needed for the circumstances. Transfers covered by UK, Swiss or UAE federal data protection law must meet the relevant rules of that jurisdiction. An ordinary enquiry does not replace this assessment. You can ask legal@exobasis.com about the basis used for your case and how to obtain an accessible copy of applicable safeguards.

The applicable rules depend on the processing activity and its connection to the people and markets concerned. Offering services specifically to people in Germany and Austria can bring an overseas provider within the EU GDPR; the UK offer similarly engages the UK GDPR. The Swiss Act covers circumstances with effects in Switzerland. The UAE federal law covers, among other situations, overseas controllers processing data of individuals in the UAE. Free zones with their own data protection legislation, and certain health and banking data, are subject to separate rules.

EU/EEA and United Kingdom

Subject to the relevant legal conditions, you can request access to and a copy of your information, correction, erasure or restriction of processing. Data portability may also apply to information you provided where automated processing is based on your consent or a contract.

Right to object: Where processing relies on legitimate interests, you can object for reasons relating to your particular situation. Continued processing must then meet the statutory conditions. You can object to direct marketing at any time. You can withdraw consent for the future; this does not affect the lawfulness of earlier processing.

We normally respond to a rights request within one month. We will tell you about any legally permitted extension or necessary clarification. If a request is refused, you will receive an explanation. You can complain to the relevant supervisory authority. In the EU this may, in particular, be the authority where you habitually live, work or consider an infringement to have occurred. In the UK you can complain to the ICO.

If you believe our handling of your personal data breaches the UK GDPR, you can make a complaint directly to Auranex LLC at legal@exobasis.com. We acknowledge complaints within 30 days of receiving them. We investigate and provide the outcome without undue delay, keeping you informed of progress. This 30-day acknowledgement period is separate from the one-month response period for rights requests described above. You may also complain to the ICO independently of this process.

Switzerland

You can request information about your data, the purposes, recipients and retention, and correction of inaccurate information. Subject to the Act's conditions, you may also request data delivery or transfer and pursue remedies against unlawful processing, including deletion or an order to stop processing. You can report suspected infringements to the Federal Data Protection and Information Commissioner (FDPIC); civil claims follow the applicable legal process.

United Arab Emirates

Where the UAE federal law applies, you can request information about processing and, subject to its conditions, correction, erasure, transfer, restriction or cessation of processing. You can withdraw consent you have given. Article 24 provides for complaints to the UAE Data Bureau under its procedures.

Processing in the Dominican Republic

Where processing falls within Law 172-13, rights include access, correction, updating or deletion under that law's conditions. You can also contact our privacy address about these rights.

The website and enquiry process described here does not make solely automated decisions about a contract or a similarly significant personal matter. Its technical spam checks and submission limits protect the form.

Further information: European Commission: individual data-protection rights; ICO: your information rights in the UK.

Retention depends on why the particular information is still needed. The following criteria apply to the first contact described here and to later assignments:

• Enquiries without a subsequent assignment: Contact details and correspondence are needed until the question has been answered and agreed follow-up has concluded. The handling purpose then ends. Further retention requires a specific legal reason or a necessary evidential purpose.
• Ongoing assignments: Necessary information remains available for delivery, handover and agreed ongoing support. On completion, records are assessed separately to establish what is still needed to fulfil the contract or establish, exercise or defend legal claims.
• Invoices and other mandatory records: The relevant statutory duties depend on the legal entity and the particular transaction. An obligation to retain an invoice does not automatically justify keeping every personal case document.
• Technical status records: The five-minute confirmation binding and ten-minute abuse counter apply only to the enquiry process described above. They are not deletion periods for emails, server logs or backups.
• Logs and backups: Error and security data may only be retained as long as necessary for their purpose. A specific security incident may require a defined set of records to be preserved for longer. Backups need their own deletion cycle; restoring a backup must not permanently undo deletions already carried out.

Send a privacy question or rights request directly to legal@exobasis.com. Briefly identify the contact or transaction concerned and explain what you are requesting. Do not send a copy of your identity document as a precaution. If there are reasonable doubts about your identity or authority to act for someone else, we will agree an appropriate check using as little additional information as possible. You do not need to buy a service or have an active assignment to make a privacy request.

Private enquiry remains the entry point for general questions. The page on protected collaboration explains how sensitive follow-up records are separated from ordinary first contact.