Legal

Privacy Policy

Last updated: 24 August 2026

This policy explains what personal data LACE collects through this website, why we collect it, how long we keep it, and the rights you have over it. It is written to the EU General Data Protection Regulation (GDPR) and to the Swiss Federal Act on Data Protection (FADP), both of which apply to us.

1. Who is responsible for your data

Two companies operate LACE and are joint controllers for the processing described here:

  • LaceSea Ltd., Suite 2, Cathedral Buildings, Middle Street, Galway, Ireland: the controller for the purposes of the GDPR.
  • LACE AG, Bahnhofstrasse 7, 6300 Zug, Schweiz: the controller for the purposes of the Swiss FADP.

For any question about this policy, or to exercise any right described in section 7, write to info(a)lace-longevity.com. We have not appointed a Data Protection Officer, because we are not required to under Article 37 GDPR: we do not carry out large-scale monitoring and we do not process special categories of data on a large scale.

2. What we collect, and why

2.1 Enquiry and application forms

When you send an enquiry through a form on this site, we receive the information you put in it. Depending on the form, that is your name, email address, telephone number, the service you are interested in, and your message. Some forms also ask for your organisation, profession, city and country, website, publication, or number of employees. Nothing on any form is collected without you typing it.

Purpose: to read your enquiry, reply to it, and carry on the conversation that follows.<br/>Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract; and Article 6(1)(a), your consent, which you give by ticking the consent box before the form will send. Under the FADP the corresponding basis is your consent together with the performance of a contract.

You are not obliged to give us any of it. If you do not, we cannot answer you, which is the only consequence.

2.2 Health information

Please do not send medical details, diagnoses or health history through the forms on this website. We do not ask for them and we do not need them to answer an enquiry. If you include such information anyway, it reaches us as part of your message and we treat it as a special category of data under Article 9 GDPR and sensitive personal data under the FADP, processed only on the basis of the explicit consent you gave by sending it, and deleted on request.

2.3 Server logs

Our hosting provider records technical information automatically when a page is requested, including the IP address, the time of the request, the page requested, and the browser user agent. This happens on every website and is what makes it possible to serve a page and to detect abuse.<br/>Legal basis: Article 6(1)(f) GDPR, our legitimate interest in operating a secure and functioning website.

2.4 The review tool

A commenting tool is available on pre-release versions of this site to the people reviewing it. It is not active for ordinary visitors. Where it is used, it records the reviewer’s name and comment, the page and the element commented on, and the size of the browser window, and it keeps the reviewer’s name in the browser’s local storage so it need not be typed again.<br/>Legal basis: Article 6(1)(f) GDPR, our legitimate interest in collecting structured feedback on our own website.

3. Cookies, measurement and your choice

Nothing on this site sets a cookie unless you ask for it. There is no advertising pixel, no social media pixel, no tag manager and no cross-site tracking of any kind, and none of that is planned.

3.1 Audience measurement, without cookies

We use Vercel Web Analytics to count page views. It sets no cookie and reads nothing from your device. A visit is recognised by a hash calculated from the request itself, which is discarded after 24 hours, so it cannot follow you to another website or connect two visits on different days. No IP address is stored. What is recorded is the page, the referring page, filtered query parameters, your approximate location from the network (country, region and city), your device type, operating system and browser.<br/>Legal basis: Article 6(1)(f) GDPR, our legitimate interest in knowing which pages are read. Because nothing is stored on or read from your device, this does not require consent, and you are not asked for any.

3.2 Google Analytics, only if you agree

We would also like to understand how people move through the site, and for that we use Google Analytics 4. It does set cookies, and it sends data to Google. So it is switched off until you say yes: if you have not answered, or you answered no, the Google Analytics script is never requested and no measurement of this kind takes place at all. Refusing changes nothing about what you can read or do here.<br/>Legal basis: your consent, Article 6(1)(a) GDPR. Google Ireland Limited acts as our processor and data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework.

We also advertise on Google, and our Google Analytics property is linked to our Google Ads account. For visitors who have agreed, and only for them, this lets Google record that an enquiry followed a click on one of our adverts, so that we can tell which adverts are worth running. About the enquiry itself, what is passed on is that an enquiry form was sent and which form it was. The name, contact details and message you write in the form are not sent to Google. If you have not agreed, none of this takes place.

Your answer is remembered in your browser’s local storage so that we do not ask on every page. To change it, clear this site’s data in your browser settings and the question will be asked again on your next visit. You can also write to us at either address in section 8 and we will confirm the position.

3.3 The review tool

The tool described in section 2.4 uses the browser’s local storage rather than a cookie, and only for people invited to review the site before release.

4. Who else sees your data

We do not sell personal data, and we do not share it for anyone else’s marketing. Your data reaches the following processors, each acting only on our instructions and each bound by a data processing agreement:

  • Vercel Inc.: hosting and content delivery for this website, and the cookieless page-view counting described in section 3.1.
  • Supabase Inc.: the service that receives an enquiry from the form and passes it on to us.
  • Resend (Plus Five Five, Inc.): delivery of the email your enquiry becomes.
  • Google Ireland Limited: Google Analytics, as described in section 3.2, and only for visitors who have agreed to it. If you have not agreed, no data about you reaches Google through this website.

Where an enquiry concerns a clinic, physician or other specialist in our network, we pass on what is needed to arrange it, and we tell you who before we do.

5. Transfers outside the EEA and Switzerland

The providers named above are established in the United States and may process data there. Those transfers are covered by the European Commission’s Standard Contractual Clauses, and by the equivalent Swiss clauses recognised by the Federal Data Protection and Information Commissioner. Google additionally self-certifies under the EU-US and Swiss-US Data Privacy Frameworks. You may ask us for a copy of the safeguards in place.

For Google Analytics specifically, no transfer happens at all unless you have agreed to it. Declining is a complete answer: there is nothing to transfer, because the script is never loaded.

6. How long we keep it

  • Enquiries that do not become a client relationship: 24 months from your last message, then deleted.
  • Enquiries that do: for the duration of the relationship, and afterwards for as long as company and tax law requires us to keep the records (ten years in Switzerland and six years in Ireland).
  • Server logs: retained by our hosting provider on its standard schedule, which does not exceed 30 days.
  • Review comments: deleted when the site the review concerns goes live.

7. Your rights

Under the GDPR and the FADP you have the right to:

  • ask what data we hold about you, and receive a copy (Article 15 GDPR);
  • have inaccurate data corrected (Article 16);
  • have your data deleted (Article 17);
  • have processing restricted while a question is resolved (Article 18);
  • receive your data in a portable, machine-readable form (Article 20);
  • object to processing carried out on the basis of our legitimate interest (Article 21);
  • withdraw consent at any time, without affecting anything done before you withdrew it (Article 7(3));
  • not be subject to a decision based solely on automated processing. We make no such decisions: every enquiry is read by a person.

Write to info(a)lace-longevity.com and we will answer within one month.

8. Complaints

If you believe we have handled your data wrongly, you may complain to a supervisory authority. The ones with jurisdiction over us are:

  • Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. dataprotection.ie
  • Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. edoeb.admin.ch

You may also complain to the authority in the EU country where you live or work.

9. Security

This site is served over HTTPS and enquiries are transmitted encrypted in transit. Access to enquiry data is limited to the people at LACE who need it to answer you.

10. Changes

If we change how we handle personal data we will update this page and change the date at the top. Where a change materially affects you and we hold your contact details, we will tell you directly.