Legal

Privacy Policy

Last updated: September 2026 · GDPR compliant

1. Data Controller

Marc Kevin Iridon
Schulstraße 14A
54597 Wallersheim
Germany

E-Mail: Info@novesso.de

2. Principles of Data Processing

We only process personal data if a legal basis under Art. 6 GDPR exists:

  • Art. 6(1)(a) GDPR – Consent (e.g. contact form, analytics)
  • Art. 6(1)(b) GDPR – Performance of a contract or pre-contractual measures
  • Art. 6(1)(f) GDPR – Legitimate interests (e.g. server logs for security and error analysis)

3. Data Collection during Website Visit

3.1 Server Log Files

Each time you visit our website, your browser automatically transmits the following data, which is stored in server log files:

  • IP address (anonymised after 7 days)
  • Date and time of access
  • Accessed URL
  • Referrer URL (referring page)
  • Browser type and operating system
  • Data volume transferred / HTTP status code

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in system security and error analysis). Data is not used for user identification and is automatically deleted after 30 days.

4. Contact Form

When you use the contact form, we process the following data:

  • Name (required)
  • Email address (required)
  • Company and company size (optional)
  • Your message

Legal basis: Art. 6(1)(a) GDPR (consent by submitting the form). Retention: 3 years after completion of correspondence (statutory retention obligation), followed by automatic deletion.

4.1 Processor: Web3Forms

The contact form is technically delivered via the service Web3Forms (Web3Creative). The data you enter is not submitted directly to our server but first to Web3Forms' infrastructure, which then forwards it to us by email. A Data Processing Agreement (DPA) under Art. 28 GDPR is in place with Web3Forms.

Data processed: The data entered in the form (name, email address, company, message) as well as technical metadata (including IP address) for spam prevention.

Infrastructure: Web3Forms operates its service via Amazon Web Services (hosting, database, email delivery via Amazon SES), Cloudflare (CDN/security), and Hetzner (application infrastructure). For spam detection, the submitter's IP address and email address are additionally transmitted to CleanTalk and Akismet.

International transfers: Web3Forms/Web3Creative is based outside the EU, and the infrastructure used (in particular AWS) may process data in the United States as well. Transfers are based on EU Standard Contractual Clauses under Art. 46(2)(c) GDPR, as set out in Web3Forms' Data Processing Agreement. Retention at Web3Forms: a maximum of 3 years, followed by automatic deletion.

Further information: Web3Forms Privacy Policy · Data Processing Agreement (DPA).

5. Cookies & localStorage

This website does not use marketing or advertising cookies. We use only technically necessary browser storage (localStorage):

  • localStorage "lang": Stores your language preference (DE/EN). No expiry date; can be deleted in your browser at any time.
  • localStorage "sch_cookie_consent": Stores your decision on analytics tracking (values: granted or denied). No expiry date; withdrawal is possible at any time (see Section 6.2).

6. External Services & Analytics

6.1 Google Fonts

This website loads fonts from Google Fonts (fonts.googleapis.com). In doing so, your IP address is transmitted to Google servers. Legal basis: Art. 6(1)(f) GDPR. Further information: Google Privacy Policy.

Note: To avoid this data transfer, fonts can alternatively be embedded locally. Contact us if this is relevant to you.

6.2 Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 is used to statistically analyse website usage and improve our offering.

Legal basis: Art. 6(1)(a) GDPR (consent). Tracking is activated only if you actively agree via the cookie banner. Without consent, no analytics data is transmitted to Google.

Consent Mode V2: We implement Google Consent Mode V2. By default, analytics_storage is set to denied. Tracking is only enabled after your explicit consent via the banner.

Data processed: Anonymised IP address (IP anonymisation enabled), page URLs accessed, referrer URL, browser type, device category, session duration, interactions. No directly personal data such as name or email is transmitted. Retention period at Google: 14 months.

International transfers: Data may be transferred to servers operated by Google LLC in the United States. The transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information: Google Privacy Policy · GA4 Data Privacy Information.

Withdraw consent: You may withdraw your consent at any time with effect for the future: Disable analytics tracking now. Alternatively, use the Google Analytics Opt-out Browser Add-on.

7. Your Rights

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR): What data we hold about you.
  • Rectification (Art. 16 GDPR): Correction of inaccurate data.
  • Erasure (Art. 17 GDPR): Deletion of your data where no retention obligations apply.
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR): Receiving your data in a common format.
  • Objection (Art. 21 GDPR): Against processing based on legitimate interests.
  • Withdrawal of consent (Art. 7(3) GDPR): At any time with effect for the future.

To exercise your rights, please contact: Info@novesso.de

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is usually the supervisory authority of your federal state or the state in which we are based. A list of German supervisory authorities can be found at: bfdi.bund.de

9. Changes to this Privacy Policy

We reserve the right to update this privacy policy in response to changes in the legal situation or changes to our data processing procedures. The current version is always available on this page. Current version: September 2026.