Legal

Privacy policy

Last updated: September 2026 · UK GDPR / Data Protection Act 2018 / EU GDPR

We take the protection of your personal data seriously. This policy explains what personal data we collect when you visit this website, request a free website audit, contact us, place an order, sign up to our newsletter or use your client account, why we use it, who we share it with and what rights you have.

Because MG Business Lab is based in Germany and offers its services to businesses in the United Kingdom, we comply with both the UK General Data Protection Regulation (UK GDPR) together with the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR). References to "GDPR" below cover both.

1. Who we are (data controller)

The controller responsible for processing your personal data is:

Owner: Milad Ghadi
Business: MG Business Lab (Sole proprietorship (Einzelunternehmen, registered in Germany)), trading as Studio Neubau
Address: Kaarster Weg 24, 40547 Düsseldorf, Germany
Email: hello@studioneubau.com
Phone: +49 211 94289198

Full company details are available in our legal notice.

2. Visiting this website (server logs)

When you visit this website, our hosting providers automatically record information your browser sends: IP address, date and time of the request, the page or file requested, amount of data transferred, whether the request succeeded, browser type and operating system, and the referring URL. We use this to deliver the website and keep it stable and secure. Our lawful basis is our legitimate interests (Art. 6(1)(f) GDPR) in operating a secure, reliable website. Log files are deleted or anonymised after 30 days at the latest.

3. Free website audit

When you request a free website audit, we process the website address (URL) and email address you provide. We fetch the website and check publicly available characteristics (for example mobile layout, loading speed, encryption and meta data). To measure speed we send the URL (not your email address) to the Google PageSpeed Insights API. We then publish your report at a private link and email it to you.

Our lawful basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interests in responding to your request and following up on it (Art. 6(1)(f) GDPR). You can object to any follow-up at any time by replying to our email or using the unsubscribe link.

4. Contact form, email and phone

When you contact us through the contact form, by email or by phone, we process the details you give us (for example your name, business name, email address, phone number and your message) to deal with your enquiry. Our lawful basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or potential contract, and otherwise our legitimate interests in answering enquiries (Art. 6(1)(f) GDPR).

5. Orders and client relationship

When you place an order, we process your business name, your name, email address, phone number (if given), current website, location, industry, the plan you chose, any notes you send us, and the content you supply for your website. We use this to prepare your draft, build and run your website, and to invoice and take payment. Our lawful basis is the performance of our contract with you (Art. 6(1)(b) GDPR) and compliance with our legal obligations, such as tax and accounting rules (Art. 6(1)(c) GDPR).

Payments are processed by Stripe. We do not see or store your full card details; Stripe processes them as an independent controller under its own privacy policy for payment and fraud-prevention purposes.

6. Client account

If you have a client account, we process your email address, a securely hashed password, your plan, project status, invoices and any service requests you send through the account. Our lawful basis is the performance of our contract with you (Art. 6(1)(b) GDPR). To keep you signed in, a session token is stored in your browser's local storage. This is strictly necessary for the account to work and is not used for tracking.

7. Newsletter

If you sign up to our newsletter, we process your email address and the date and time of your sign-up and confirmation. We use a double opt-in: you will only receive the newsletter after clicking the confirmation link we email to you. Our lawful basis is your consent (Art. 6(1)(a) GDPR, and the Privacy and Electronic Communications Regulations 2003 where applicable). You can withdraw your consent at any time using the unsubscribe link in every email or by emailing us. Withdrawal does not affect the lawfulness of processing before it.

8. Cookies, analytics and local storage

This website does not use tracking, analytics or marketing cookies, so we do not need a cookie banner. We use Cloudflare Web Analytics, which is cookieless and does not build a profile of you; it gives us aggregated figures such as page views. Our lawful basis is our legitimate interests in understanding how the website is used (Art. 6(1)(f) GDPR).

If you arrive via a link with campaign parameters (UTM parameters), we store these temporarily in your browser's session storage so we can see which campaign an enquiry came from. They are deleted when you close the tab and are not shared with third parties. If we ever introduce cookies or similar technologies that require consent, we will ask for your consent first.

9. Fonts

The fonts on this website are served from our own server. No connection is made to third-party font services (such as Google Fonts), so your IP address is not shared with a font provider.

10. Service providers (processors)

We use carefully selected service providers to run our website and services. Where they process personal data on our behalf, we have a data processing agreement with them in line with Art. 28 GDPR:

Supabase, Inc. (USA): database, authentication and backend for form submissions, orders and client accounts.
Resend, Inc. (USA): sending audit reports, confirmations, newsletters and other emails.
Railway Corporation (USA): hosting of the website application.
Cloudflare, Inc. (USA): content delivery, security and cookieless web analytics.
Google Ireland Limited / Google LLC: PageSpeed Insights API for the speed test in website audits (only the URL is sent).
Stripe Payments Europe, Ltd. / Stripe, Inc.: payment processing (see section 5).

11. International transfers

We are based in Germany, in the European Economic Area. The UK recognises the EEA as providing adequate protection, and the EU recognises the UK as adequate, so data can flow between the UK and Germany.

Some of our providers are based in, or access data from, the United States. Where personal data is transferred there, we rely on the EU-U.S. Data Privacy Framework and the UK Extension to it (the "UK-US data bridge") where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with the UK International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.

12. How long we keep your data

Server logs: up to 30 days.
Audit requests and enquiries that do not lead to a contract: deleted once the request is closed, and no later than 12 months after our last contact.
Client and contract data: for the duration of our contract and afterwards as long as needed for possible claims.
Invoices and accounting records: as required by German tax and commercial law (generally 8 to 10 years).
Newsletter: until you unsubscribe. We keep a record of your consent and unsubscribe for as long as needed to prove it.

13. Your rights

Under UK GDPR and EU GDPR you have the right to:

access the personal data we hold about you (Art. 15)
have inaccurate data corrected (Art. 16)
have your data erased (Art. 17)
restrict processing (Art. 18)
data portability (Art. 20)
object to processing based on legitimate interests, and to direct marketing at any time (Art. 21)
withdraw your consent at any time, with effect for the future (Art. 7(3))

To exercise any of these rights, simply email us at hello@studioneubau.com. We will respond within one month. We do not make decisions about you based solely on automated processing.

14. Right to complain

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to a supervisory authority:

In the UK: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk.
In Germany (our lead authority): the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information), Kavalleriestr. 2-4, 40213 Düsseldorf.

15. Changes to this policy

We may update this privacy policy to reflect changes in the law or in our services. The version published on this page at the time of your visit applies.

16. Contact

If you have any questions about this policy or about your data, email us at hello@studioneubau.com or write to MG Business Lab, Kaarster Weg 24, 40547 Düsseldorf, Germany.