MunOx

Legal

Privacy Policy

Last updated: September 2026

This policy explains what personal data MunOx processes when you visit munox.eu or use one of our forms, what we use it for, who processes it on our behalf, and what rights you have. We do not sell your data, and we only share it in the cases described here.

1. Controller

MunOx UG (haftungsbeschränkt)
Hulbepark 9
21029 Hamburg
Germany
Email: hello@munox.eu
Managing Director: Julius Lagies

For any question about data protection, write to hello@munox.eu. We are not legally required to appoint a data protection officer.

2. Visiting the website

Hosting and server logs

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that Vercel processes to deliver the page and keep the service secure:

  • IP address
  • Date and time of the request
  • The page requested and the page you came from (referrer)
  • Browser, operating system and device type

Vercel keeps these server logs for a short time and then deletes them automatically.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and stable website. Vercel is certified under the EU–US Data Privacy Framework (Art. 45 GDPR). For more information: vercel.com/legal/privacy-policy

Protection against abuse

To prevent automated abuse of our forms, each time you submit one we hold your IP address and the email address you entered in our server's working memory for up to an hour, and count how often the IP address has submitted within the last minute and the email address within the last hour. Neither is stored permanently or combined with any other data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing spam and overload.

Fonts and images

We serve this website's fonts and images from our own server. Apart from the web analytics described in section 3, your browser does not contact Google Fonts or any other third party when you visit our pages.

3. Web analytics (PostHog)

We use PostHog to understand how our website is used — for example which pages are visited and in what order — and to improve it on that basis. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog's EU cloud; the data is stored on servers in the European Union (Frankfurt am Main).

PostHog is set up so that no cookies are set and nothing is stored in your browser. Every visit therefore counts as a new one: we cannot recognise you when you come back, and we do not build profiles of individual visitors.

PostHog processes:

  • Pages viewed, the page you came from, and time spent
  • Clicks on links and buttons
  • Browser, operating system, device type and screen size
  • Your IP address, from which an approximate location (country and city) is derived

We do not record your screen, and we do not capture what you type into forms.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding and improving our website. You can object to this processing at any time (see section 9); disabling JavaScript or using a tracker blocker also prevents it. We have a data processing agreement with PostHog; any transfer of data to the USA is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For more information: posthog.com/privacy

4. Forms

Every form on this website sends what you enter to our server. From there it is stored in our workspace at Notion, and you receive a confirmation email sent through Resend (see sections 5 and 6). You can leave fields marked as optional empty.

Joining the network

When you apply for membership, we process: your name, email address, city and country, university or organisation (optional), areas of interest, a short text about you and — if you upload one — your CV (PDF or DOCX, up to 3 MB). We use this to assess your application and, if you are accepted, to manage your membership.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request before entering into a membership). We keep the data for as long as you are a member. If we do not accept your application, we delete it no later than six months after our decision.

Membership emails. Membership includes emails from us about your application and your membership, including invitations to events, challenges and opportunities for members. When you apply, you confirm that you accept this privacy policy and our Terms of Use (munox.eu/terms). The legal basis for these emails is Art. 6(1)(b) GDPR.

Newsletter. In the same form you can also sign up to our newsletter, with news from MunOx, the network and our partners. It is optional and has no bearing on your application. The legal basis is your consent under Art. 6(1)(a) GDPR; we record whether and when you gave it. You can withdraw it at any time, with effect for the future (see section 5).

Partnership enquiries

When you contact us on behalf of an organisation, we process: the organisation's name, the contact person's name, email address, type of organisation, your area of interest and your message. We use this to answer your enquiry and to prepare a possible partnership.

The legal basis is Art. 6(1)(b) GDPR and, where you write on behalf of an organisation, Art. 6(1)(f) GDPR (our legitimate interest in answering business enquiries). We keep the data until your enquiry has been dealt with. If a partnership follows, we keep it for the duration of the partnership and beyond that where statutory retention periods apply (up to ten years under German commercial and tax law).

Applications for roles and challenges

When you apply for a role or a challenge, we process: your name, email address, the role or challenge, organisation (optional), city and country, availability, LinkedIn profile and portfolio or website (optional), your personal statement, how you heard about us and — if you attach one — your CV. An attached CV is also sent by email, together with your details, to our team's inbox.

If the role or challenge is offered by a partner organisation, we pass your application on to that organisation so it can consider it. The partner organisation then processes your data as a controller in its own right.

The legal basis is Art. 6(1)(b) GDPR. If no collaboration follows, we delete your application six months after the process ends; we keep it until then so that we can defend ourselves against any legal claims (Art. 6(1)(f) GDPR).

Waitlist

While the website is in its pre-launch phase, you can join a waitlist. We process your email address, your category (Student, Young Professional, Company or Other) and your country (optional) in order to let you know when MunOx launches.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time by emailing hello@munox.eu. We keep the data until MunOx launches or until you withdraw your consent, whichever comes first.

Notification of new events

When no events are announced, you can leave your email address on our events page so that we can tell you about the next one. The address is sent by email to our mailbox for this (see section 5) and is not stored in Notion. We use it for that purpose only. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time. We delete the address once we have notified you or when you withdraw.

5. Emails

After each form we send you a confirmation email. We also send members membership emails and, if they signed up for it, our newsletter (see section 4).

Our newsletter and any other marketing email end by telling you how to unsubscribe: write to hello@munox.eu and we will stop sending you emails of that kind. Confirmations you trigger yourself by sending a form do not carry this note.

We send emails through Resend (Resend, Inc., USA). Resend processes your email address, the content of the message and delivery data, such as whether the email was delivered. The legal basis is Art. 6(1)(b) GDPR or your consent, as applicable. The transfer to the USA is safeguarded by the EU Standard Contractual Clauses. For more information: resend.com

Our mailboxes, including hello@munox.eu, are hosted by Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus). When you email us, or when an application with a CV reaches us through our form, Hostinger stores that message on our behalf on servers in the EU. The legal basis is Art. 6(1)(b) GDPR where your message concerns an application, a membership or a partnership, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering you). For more information: hostinger.com/legal/privacy-policy

Our emails load their fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). If your email program displays web content, it connects to Google's servers, which receive your IP address. Many email programs block this by default. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a consistent appearance of our emails.

6. Service providers and transfers outside the EU

The following providers process data on our behalf and only on our instructions (Art. 28 GDPR):

  • Vercel Inc., USA — website hosting; EU–US Data Privacy Framework
  • Notion Labs, Inc., 2300 Harrison St, San Francisco, CA 94110, USA — storing form submissions and CVs; EU Standard Contractual Clauses
  • Resend, Inc., USA — sending emails; EU Standard Contractual Clauses
  • PostHog Inc., USA, with data stored in the EU — web analytics; EU Standard Contractual Clauses
  • Hostinger International Ltd., Cyprus — hosting our email mailboxes; processing in the EU

You can request a copy of the relevant safeguards at hello@munox.eu.

7. Links to other websites

Registration for our events takes place on Luma (luma.com), a separate service with its own privacy policy. Luma collects your registration details as a controller in its own right. As the event's organiser we receive the details you give there (such as your name and email address) and use them to run the event. The legal basis is Art. 6(1)(b) GDPR.

Links to LinkedIn and other websites are plain links. No data is sent to those providers unless you click one.

8. How long we keep data

We keep personal data only for as long as the purpose requires and then delete it, unless statutory retention obligations apply. The specific periods are given with each type of processing above.

9. Your rights

You have the right to:

  • Access the data we hold about you (Art. 15 GDPR)
  • Have inaccurate data corrected (Art. 16 GDPR)
  • Have your data erased (Art. 17 GDPR)
  • Restrict processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR)

To exercise any of these, email hello@munox.eu.

Right to object: where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to that processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing it unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, datenschutz-hamburg.de

10. Whether you have to provide data

You are under no legal or contractual obligation to give us any data. Without the fields marked as required, however, we cannot process an application or enquiry. We do not use automated decision-making, including profiling (Art. 22 GDPR).

11. Changes

We update this privacy policy when our website or our processing changes. The version published on this page applies.