Privacy policy

Controller for data processing on this website:

Marko Grle, nivion

Gustav-Adolf-Straße 25A, 90439 Nürnberg, Germany

Phone: +49 1511 7960521

Email: hello@nivion.io

A data protection officer is not required by law in this case.

When you open the site, your browser sends technically necessary data to our hosting provider: IP address, date and time of the request, the page requested, the referring URL, and browser and operating system identifiers.

This processing is required to deliver the site and keep it stable and secure. The legal basis is Art. 6(1)(f) GDPR. The log files are not combined with any other source and are deleted automatically: access logs after five weeks at the latest, error logs after eleven weeks at the latest.

If you write to us through the form, we process your name, email address, optionally your company name, the project type you chose, and your message.

We use this only to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual steps, otherwise Art. 6(1)(f) GDPR.

Delivery runs through Resend, Inc. as a processor. We keep enquiries for as long as handling them and statutory retention periods require.

This site sets exactly one cookie: NEXT_LOCALE. It stores only the language the site was last shown in, so it opens in the same language next time. It is valid for at most one year.

It holds no identifier that could recognise you and is never sent to third parties. It is strictly necessary for the service you requested, so no consent is required under Section 25(2)(2) TDDDG.

Further cookies are set only if you agree to analytics or marketing in the banner. See the next section.

To see which pages are opened we use the open-source software Umami. It runs on our own server at Hetzner in Nuremberg; no connection to any third party is made.

Umami sets no cookies and stores nothing in your browser. It records the page opened, the referring URL, browser and device type, screen size and the country of the request. Your IP address is used only transiently to derive a daily-rotating session key that cannot be traced back to you, and is not stored.

Because the site sets no cookies and stores nothing on your device for this, no consent is required under Section 25(1) TDDDG. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is knowing which content is read. You can object by enabling “Do Not Track” in your browser; the measurement respects that signal.

The statistics are not combined with other data and are not passed to third parties.

This site may use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Tag Manager itself sets no cookies and evaluates no data; it only loads the tools you agreed to in the banner. Until you agree, the container is not even fetched: no connection to Google is made, no script is loaded and no cookie is set.

You decide on two purposes separately. Analytics loads Google Analytics 4, which sets cookies (including _ga) and processes truncated IP addresses, device and browser data and your behaviour on the site. With your consent to marketing we may load advertising tags from Google Ads, which let us measure whether an ad led to an enquiry and show you ads again later (remarketing). If no such tag is active, this consent loads nothing additional.

Google signals is enabled in Google Analytics. For visitors who are signed in to a Google account and have allowed personalised advertising there, Google can combine the use of this site across devices and provide us with reports on age, gender and interests. We see those reports only in aggregate, never individual people. Google deletes age, gender and interest data after two months, regardless of the retention stated below.

We use consent mode v2. Your decision is passed to Google as a signal: analytics_storage for analytics, and ad_storage, ad_user_data and ad_personalization for marketing. Before you decide, all four signals stand at “denied”.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google processes the data as a processor under the Google Ads Data Processing Terms. Data may be transferred to the USA; Google relies on the European Commission's standard contractual clauses and on the EU-US Data Privacy Framework. In Google Analytics, user and event data are limited to a retention of 14 months.

Your choice is stored locally in your browser, not in a cookie. You can change or withdraw it at any time through “Privacy settings” in the footer; the banner then asks again. A withdrawal takes effect for the future.

All fonts are served from our own server. Loading the page opens no connection to Google Fonts or any other font provider, and no IP address reaches a third party.

We run no heatmaps, no session recording, no advertising pixels and no advertising networks. Without your consent the page loads nothing from third-party domains; our own analytics run only on our own server.

Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany, so hosting involves no transfer to a third country.

Contact form email delivery: Resend, Inc., USA.

Analytics and marketing after consent: Google Ireland Limited, Ireland (Google Tag Manager, Google Analytics, Google Ads), under the Google Ads Data Processing Terms.

Data processing agreements under Art. 28 GDPR are in place with all of them. Email delivery and Google Analytics can involve a transfer to the USA; that relies on the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on Art. 6(1)(f) GDPR.

An informal message to hello@nivion.io is enough.

You may also lodge a complaint with a data protection supervisory authority, usually the one where you live or where we are established.