Privacy policy

Last updated: 5 November 2026

This page still contains marked placeholders. They must be replaced with the real details before publication (file lib/site.ts).

This policy describes which personal data is processed when you visit northspacelab.com. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). In short: we use no tracking cookies, no analytics or advertising services and no embedded third-party content. We process personal data only when you write to us, sign up for updates, apply or create an account.

1. Controller

2. Visiting the website and server logs

With every visit your browser transmits technically required data, which we store in log files:

• IP address (via Cloudflare usually the address of the Cloudflare server)
• Date and time, requested address, HTTP status code and amount of data transferred
• Referrer URL as well as browser and operating system (user agent)

The purpose is secure and stable operation, in particular defence against attacks and troubleshooting. Logs are deleted automatically after 14 days at the latest, unless they are needed longer to investigate a specific security incident. The legal basis is our legitimate interest in secure operation (Art. 31 para. 1 FADP; Art. 6(1)(f) GDPR).

The language of the site (German or English) is chosen from the country of your connection, which Cloudflare determines for this request. We do not store the country.

3. Hosting and content delivery (Cloudflare)

The website runs on our own server in [Land des Serverstandorts]. Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) sits in front of it. Cloudflare forwards all requests, protects against attacks and provides the encrypted connection. In doing so Cloudflare processes the connection data named in section 2, also in the USA.

The transfer relies on the Swiss-U.S. and the EU-U.S. Data Privacy Framework where Cloudflare is certified, and on the standard contractual clauses in Cloudflare's data processing agreement. To protect against automated attacks Cloudflare may set technically necessary cookies (for example __cf_bm or cf_clearance). The legal basis is our legitimate interest in a secure and fast service. More information: Cloudflare privacy policy.

4. Cookies and local storage

We set a cookie only if you sign in: a technically necessary session cookie (nsl_session) that keeps you signed in. It contains only a random identifier, cannot be read by scripts (HttpOnly), is sent only over encrypted connections (Secure), lasts up to 30 days and disappears when you sign out. If you use the language switch we also store your choice in a cookie (nsl-lang, 12 months); it contains only "de" or "en". In your browser's local storage (localStorage) we keep two settings: your choice in the cookie notice (so that it does not appear on every visit; we ask again after twelve months) and, if you change it, the chosen appearance, light or dark. These details do not leave your device. Details are on the Cookies page.

5. Fonts and images

Fonts, images and graphics are hosted on our own server. No content is loaded from Google Fonts, CDNs or other third parties.

6. Contact form and email

If you write to us through the contact form or by email, we process your details to answer the request. With the form these are your name, email address, optionally your organisation, the chosen topic, your message and the time of receipt. The data is stored only on our own server and is not passed on to third parties or email services.

To protect against misuse we use a field that is invisible to people and limit the number of messages per sender. For this your IP address is used briefly in memory but not stored together with your message. No third-party captcha services are used.

We delete your request as soon as it is dealt with, and at the latest twelve months after receipt, unless statutory retention duties apply. The legal basis is processing your request and our legitimate interest in communication (Art. 31 para. 1 FADP; Art. 6(1)(b) and (f) GDPR).

7. Updates list

In the footer of the website you can sign up for updates with your email address. No account or password is needed for this. So that nobody can sign up other people's addresses, we first send you a confirmation email (double opt-in); only when you click the link in it (valid for 48 hours) are you added. Nothing is stored without that confirmation. Only your email address, the time of sign-up, the language and a random identifier are stored. Your IP address is not stored. To curb misuse (too many sign-ups or emails to the same address) we briefly keep counters made only of irreversible checksums of address and IP, deleted after one hour.

The data is kept exclusively on our own server and is not passed on to third parties, newsletter services or advertising partners. We send one email per week, on Saturdays (currently a ten-week series, "Part of the week"), and no advertising. The emails contain images loaded from our own server. They are the same files for every recipient, without a personal identifier, so we cannot tell who opened an email, and we use no tracking. Loading the images only creates the usual connection data described in section 2. For sending we keep a log without addresses (checksums of the recipient identifier so that no episode arrives twice; error messages without addresses). We keep your address until you unsubscribe. Every email contains a personal unsubscribe link for this (one click, nothing to type); mail programs also show it as an "Unsubscribe" button. Alternatively use the page Unsubscribe from updates. Your address is then deleted immediately. The legal basis is your consent (Art. 31 para. 1 FADP; Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

8. Account and sign-in

You can create a free account and sign in with it. There is no password: you enter your email address and we send you a sign-in link that is valid for 15 minutes and can be used once. By clicking it your account is created if you do not have one yet, and you are signed in.

We store your email address, the time the account was created, your setting whether you receive news by email, your language, your voluntarily chosen display name and your pattern profile picture (there are no uploads), as well as technically necessary session data (as a non-reversible checksum). The data is kept exclusively on our own server. Your IP address is not stored; it is only used briefly in memory to slow down too many attempts. For this we keep hourly counters made of irreversible checksums of address and IP, deleted after one hour. Expired or used sign-in links are deleted at the next sign-in attempt. To send sign-in links and news we send emails through our own mail server: sending is done via our own mail server, with no external provider. The receiving mail servers (for example of your provider) technically receive your address and the message.

We keep your account until you delete it. You can do this yourself at any time in the account under "Delete account"; your address, profile and all sessions are then removed immediately and completely, as is an entry for the same address on the updates list. You receive news emails only if you explicitly choose this at registration or later in the account (once a week, on Saturdays), and you can turn it off at any time. The legal basis is providing the account and, for news, your consent (Art. 31 para. 1 FADP; Art. 6(1)(a) and (b) GDPR).

9. Mission control (app.northspacelab.com)

Mission control at app.northspacelab.com shows measurements, cameras and events of the mission. It sets no cookies, requires no sign-in and stores no personal data. At most the chosen appearance, light or dark, is kept in your browser's local storage. On access the same technical connection data arises as described in sections 2 and 3.

10. Applications

You can apply through the form on the Careers page. We store your name, email address, chosen area, your text, an optional link to a CV or work, and the time of receipt. We do not accept files. The data is kept exclusively on our own server and is not passed on to third parties. Your IP address is only used briefly in memory to slow down too many submissions and is not stored.

We delete your application at the latest six months after receipt, earlier on request. The legal basis is taking steps prior to entering into a contract and your consent (Art. 31 para. 1 FADP; Art. 6(1)(a) and (b) GDPR).

11. Links to other websites

We link to third-party websites, for example sideforge.ch. When you click, you leave our website; the operators of those sites are responsible for how your data is processed there.

12. Disclosure

We do not sell data and do not pass it on for advertising purposes. Disclosure takes place only to the technical service providers named above or if there is a legal obligation. We make no automated individual decisions and create no profiles.

13. Data security

The connection to the website is encrypted with TLS. We protect our systems with appropriate technical and organisational measures against loss, misuse and unauthorised access.

14. Your rights

You can request information about the data we hold about you at any time, as well as its correction, deletion or release. You can object to processing and withdraw any consent given at any time. Where the GDPR applies you also have the right to restriction of processing and to data portability. Write to us for this at the address given above.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. In the EU the supervisory authority of your place of residence is competent.

15. Changes

We adapt this policy when the website or the legal situation changes. The version published here applies.