Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Koh Labs LLC
30 N Gould St, Ste N
Sheridan, WY 82801, US
Email: aaron@ninja.partners

2. Scope & legal framework

Koh Labs LLCis established in the United States and has no establishment in the EU. We process personal data of visitors in the EU/EEA in accordance with the EU General Data Protection Regulation (GDPR), which applies to us because we offer services to, and monitor the behaviour of, visitors in the Union (Art. 3(2) GDPR). For visitors in California, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) applies. Where national e-privacy rules apply in a visitor's country (for example § 25 TDDDG in Germany), storing or reading non-essential information on your device requires your prior consent.

3. Hosting & server logs

This website is hosted by Vercel Inc. When you access the site, technical data (e.g. IP address, browser type, time of request) is processed to deliver the site securely. Legal basis: our legitimate interest in operating a secure and stable website (Art. 6(1)(f) GDPR).

4. Cookies & consent

We use strictly necessary cookies to operate the site and to remember your cookie choice. Non-essential cookies and similar technologies (analytics, marketing) are only set after you give consent via our cookie banner. Consent is voluntary and can be withdrawn at any time with effect for the future via Cookie settings.

Legal basis for consent-based processing: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

5. Google Analytics 4

With your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). GA4 uses cookies and similar identifiers to analyse how visitors use the site. IP addresses are not stored in raw form by GA4. We operate Google Consent Mode v2: no analytics cookies are set until you consent.

Recipient: Google Ireland Limited / Google LLC.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Retention: user- and event-level data is retained for 2 months. Aggregated standard reports are retained independently of this setting.
Third-country transfer: data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection.

6. Marketing & advertising

We currently do not use advertising, remarketing or social-media tracking tools on this website. Should we introduce such tools in the future (for example LinkedIn Insight Tag, Meta Pixel or Google Ads), we will update this policy and load them only after you give your consent. Legal basis for any future consent-based processing: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

7. Contact by email

If you contact us by email, the data you provide will be processed to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual / contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

8. EU representative (Art. 27 GDPR)

Koh Labs LLC has no establishment in the EU. A controller without an EU establishment that offers services to data subjects in the Union must, in principle, designate a representative in the Union under Art. 27 GDPR, unless an exemption applies — in particular where processing is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to data subjects.

[We consider this exemption likely to apply to this website. To be confirmed by counsel; if a representative is appointed, their name and address will be inserted here.]

9. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.

10. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of your personal information, to correct inaccurate personal information, and not to be discriminated against for exercising your rights.

Categories we process on this website: identifiers (e.g. IP address) and internet/network activity (e.g. analytics data), as described in sections 3 to 5.
Sale / sharing: we do not sell your personal information, and we do not share it for cross-context behavioural advertising.
How to exercise your rights: contact us at aaron@ninja.partners. We verify requests using the email or account information associated with you.

11. Changes to this policy

We may update this Privacy Policy to reflect changes to our processing or legal requirements. The current version applies.