1. Name and contact details of the data controller and the company data protection officer

    This privacy policy applies to data processing carried out by:

    Data controller:
    T-Balance Therapeutics GmbH (hereinafter: T-Balance Therapeutics)
    Waldfriedstraße 4
    60528 Frankfurt am Main, Germany
    Email: sl.ext [at] t-balance-therapeutics [dot] com
    Telephone: +49 69 66163745
    Fax: +49 69 6663008

    Company Data Protection Officer:
    The company data protection officer at T-Balance Therapeutics can be contacted at the following address:
    Scheja & Partner Rechtsanwälte mbB
    Adenauerallee 136
    53113 Bonn
    for the attention of Mr Florian Reichert
    Email: info [at] scheja-partner [dot] de

    2. Collection and storage of personal data, and the nature and purpose of its use

    A. When visiting the website (server log files)

    When you access our website www.t-balance-therapeutics.com, the browser used on your device automatically sends information to our website’s server. This information is temporarily stored in a so-called log file. The following information is collected automatically without any action on your part and stored until it is automatically deleted:

    • IP address of the requesting computer,
    • date and time of access,
    • name and URL of the file accessed,
    • website from which access is made (referrer URL),
    • browser used and, where applicable, your computer’s operating system, as well as the name of your internet service provider.

    We process the aforementioned data for the following purposes:

    • To ensure the website connects smoothly,
    • to ensure a user-friendly experience on our website,
    • to evaluate system security and stability, and
    • for other administrative purposes.

    The legal basis for data processing is Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interest arises from the purposes of data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your identity.

    In addition, we use cookies and analytics services when you visit our website. Further details on this can be found in sections 5 and 6 of this privacy policy.

    B. When using our contact form or contacting us by email

    If you have any enquiries, we offer you the option of contacting us via a form provided on the website or by email. You must provide a valid email address so that we know who the enquiry is from and can reply to it. Further details may be provided on a voluntary basis.

    The processing of this data is based on Article 6(1), first sentence, point (b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1), first sentence, point (f) of the GDPR) or on your consent (Article 6(1), first sentence, point (a) of the GDPR), provided that such consent has been sought.

    The personal data we collect when you use the contact form will be deleted once your enquiry has been fully dealt with, provided that there are no statutory retention obligations (e.g. under commercial or tax law) that prevent this.

    3. Web hosting

    This website is hosted by an external service provider (WEFRA LIFE GmbH, Mitteldicker Weg 1, 63263 Neu-Isenburg). Personal data collected on this website is stored on the host’s servers. This may primarily include IP addresses, contact enquiries, metadata and communication data, contractual data, contact details, names, website visits and other data generated via a website.

    The hosting provider is engaged for the purpose of fulfilling our contractual obligations towards our potential and existing customers (Article 6(1), first sentence, point (b) of the GDPR) and in the interests of ensuring the secure, fast and efficient provision of our online services by a professional provider (Article 6(1), first sentence, point (f) of the GDPR).

    Our hosting provider will only process your data to the extent necessary to fulfil its service obligations and will comply with our instructions regarding this data.

    Conclusion of a data processing agreement:

    To ensure that data is processed in accordance with data protection regulations, we have concluded a data processing agreement (DPA) with our hosting provider in accordance with Article 28 of the GDPR.

    4. Disclosure of data

    Your personal data will not be disclosed to third parties for purposes other than those listed below. We will only disclose your personal data to third parties if:

    • you have given your explicit consent in accordance with Article 6(1)(a) of the GDPR,
    • the disclosure is necessary in accordance with Article 6(1)(f) of the GDPR for the establishment, exercise or defence of legal claims, and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
    • in the event that there is a legal obligation to disclose data in accordance with Article 6(1), first sentence, point (c) of the GDPR, and
    • this is permitted by law and necessary under Article 6(1), first sentence, point (b) of the GDPR for the performance of contractual relationships with you.

    5. Cookies

    We use cookies on our website. These are small text files that your browser automatically creates and which are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your device and do not contain any viruses, Trojans or other malware. Information is stored in the cookie that relates to the specific device being used. However, this does not mean that we thereby gain direct knowledge of your identity.

    On the one hand, we use technically necessary cookies (e.g. so-called session cookies) to ensure the basic functionality of our website and to recognise that you have already visited individual pages of our website or which settings you have selected in the cookie banner. Session cookies are automatically deleted when you leave our site.

    The storage and reading of technically necessary cookies on your device are carried out on the basis of Section 25(2)(2) of the TDDDG (Telecommunications and Digital Services Data Protection Act). The subsequent processing of personal data is carried out to safeguard our legitimate interests in the technically fault-free and optimised provision of our services in accordance with Article 6(1), first sentence, point (f) of the GDPR.

    Furthermore – provided you have given your express consent – we use cookies to collect statistical data on the use of our website and to analyse this data for the purpose of optimising our offering for you (see section 6). These cookies enable us to automatically recognise that you have previously visited our site when you return. These cookies are automatically deleted after a defined period:

    Cookie name

    Purpose

    Retention period

    Provider

    _ga

    Used to distinguish between users statistically

    2 years

    Google

    _ga_<container-id>

    Used to maintain session status

    2 years

    Google

    (Note: If Universal Analytics cookies or Google settings cookies such as _gid, _gat or NID are still active on the site, these will also only be set following your consent, with a duration of between 24 hours and 6 months).

    The legal basis for storing and reading these analytics cookies on your device is your consent in accordance with Section 25(1) of the TDDDG. The subsequent data processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time via the cookie settings on our website, with effect for the future.

    Furthermore, you can configure your browser so that no cookies are stored on your device or so that a notification always appears before a new cookie is created. However, completely disabling cookies may mean that you are unable to use all the features of our website.

    6. Google Analytics

    For the purpose of designing our website to meet your needs and continuously optimising it, we use – provided you have given your consent – Google Analytics, a web analytics service provided by Google LLC. For the European region, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter ‘Google’), is the data controller.

    Google Analytics uses cookies (see section 5) which enable an analysis of your use of the website and assign interactions to a pseudonymous user ID. In this context, pseudonymised usage profiles are created. The information generated by the cookie regarding your use of this website, such as:

    • browser type/version,
    • operating system used,
    • referrer URL (the previously visited page),
    • truncated IP address,
    • time of the server request,

    is usually transmitted to a Google server and stored there. This may also involve transmission to servers operated by Google LLC in the USA.

    In Google Analytics (version 4), IP address anonymisation is enabled by default. This means that your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area before it is stored or further processed. The IP address transmitted by your browser as part of Google Analytics is not merged with other data held by Google.

    For data transfers to the USA, Google LLC is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA designed to ensure compliance with European data protection standards when data is processed in the USA. On this basis, the European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR. In addition, we have entered into standard contractual clauses with Google in accordance with Article 46(2)(c) of the GDPR.

    The information is used by Google on our behalf to analyse the use of the website, to compile reports on website activity and to provide other services relating to website and internet usage for the purposes of market research and the needs-based design of these web pages.

    The legal basis for the use of Google Analytics is your voluntary consent in accordance with Section 25(1) of the Telecommunications and Digital Services Data Protection Act (TDDDG) in conjunction with Article 6(1), first sentence, point (a) of the GDPR.

    Withdrawal of consent: You may withdraw your consent at any time with future effect by accessing the cookie settings (consent banner) on our website and changing your selection there.

    Furthermore, you can prevent the collection of data generated by the cookie and relating to your use of the website, as well as the processing of this data by Google, by downloading and installing a browser add-on: https://tools.google.com/dlpage/gaoptout?hl=de.

    Further information on the terms of use and data protection for Google Analytics can be found at https://marketingplatform.google.com/about/analytics/terms/de/ and in Google’s privacy policy at https://policies.google.com/privacy?hl=de.

    7. Google Fonts (Local Hosting)

    We use so-called Google Fonts on our website to ensure a consistent and attractive display of fonts; these are provided by Google LLC.

    To ensure the protection of your personal data, Google Fonts are installed locally on our own web server. When you visit our website, your browser loads the required fonts directly from our server. No connection is made to Google’s servers, meaning that no IP addresses or other usage data are transmitted to Google.

    8. Data subjects’ rights

    You have the right:

    • in accordance with Article 15 of the GDPR to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details;
    • in accordance with Article 16 of the GDPR to request, without undue delay, the rectification of inaccurate personal data or the completion of your personal data stored by us;
    • in accordance with Article 17 of the GDPR to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
    • in accordance with Article 18 of the GDPR to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer require the data, but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing in accordance with Article 21 of the GDPR;
    • in accordance with Article 20 of the GDPR to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format, or to request that it be transferred to another controller;
    • in accordance with Article 7(3) of the GDPR to withdraw your consent, once given, at any time. As a result, we may no longer continue the data processing that was based on this consent in future, and
    • in accordance with Article 77 of the GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority for your usual place of residence or work, or for the location of our registered office.

    9. Right to object

    Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1), first sentence, point (f) of the GDPR, you have the right, pursuant to Article 21 of the GDPR, to object to the processing of your personal data, provided there are grounds arising from your particular situation or the objection relates to direct marketing. In the latter case, you have a general right to object, which we will honour without you needing to specify a particular situation.

    If you wish to exercise your right of withdrawal or right to object, simply send an email to: sl.ext [at] t-balance-therapeutics [dot] com

    10. Data security

    During your visit to our website, we use the widely adopted SSL/TLS (Transport Layer Security) protocol in conjunction with the highest level of encryption supported by your browser. You can tell whether a particular page on our website is being transmitted in encrypted form by the closed padlock symbol in your browser’s address bar and by the fact that the address begins with https://.

    We also employ appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

    11. Validity and amendments to this privacy policy

    This Privacy Policy is currently valid and is dated October 2026.

    Due to the further development of our website and the services offered via it, or as a result of changes to legal or regulatory requirements, it may become necessary to amend this Privacy Policy. You can access and print the current version of the Privacy Policy at any time on the website at https://www.t-balance-therapeutics.com/data-protection-declaration/.