Privacy Policy

What data do we process? What you enter in the Qualification form, the technical data every web server records, and, if you allow it, analytics data about your visit.

Do we process sensitive data? No.

Who receives it? Our hosting provider, our CRM, and, with your consent, Google Analytics. Each is named in section 4.

Do we sell data or advertise with it? No. We run no ad network, no retargeting, and no profiling for advertising.

What are your rights? Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Section 9 says how.

• 1. What information do we collect?
• 2. How do we process your information?
• 3. What legal bases do we rely on?
• 4. When and with whom do we share your information?
• 5. Do we use cookies and tracking technologies?
• 6. How long do we keep your information?
• 7. How do we keep your information safe?
• 8. Do we collect information from minors?
• 9. What are your privacy rights?
• 10. Controls for do-not-track features
• 11. Do we make updates to this notice?
• 12. How can you contact us about this notice?
• 13. How can you review, update, or delete your data?

In short: We process what you type into the form, what your browser sends, and what our CRM adds about your company from public business sources.

Data you give us. When you request a Qualification, we process your name, your work email address, your company, your role, your description of what should run on its own, the self-check lines you tick, and a phone number if you enter one. We store the wording of the privacy note shown under the form button together with the moment you sent the form, so that we can always show what you were told. If the link that brought you carried campaign parameters (utm_source, utm_medium, utm_campaign), we store those and the page URL as well. The form sets no cookie.

Sensitive data. We do not process special categories of personal data under Art. 9 GDPR, and the form does not ask for any.

Data collected automatically. Our hosting provider records server logs for every request: IP address, date and time, the page requested, referring URL, browser and operating system. Vercel Web Analytics counts visits by page, country, browser, and device type without cookies and without tracking you across websites. If you allow it, Google Analytics additionally records which pages you read, how you reached the site, and whether you sent the form, under a pseudonymous identifier stored in a cookie.

Data from other sources. Our CRM enriches the company record behind your email domain, and where available the contact record, from publicly accessible and licensed business sources. This is how we know who we are talking to before the first call. We buy no data for advertising and build no profile beyond the business context of your request.

In short: To handle your request, to answer you, to keep the site running and secure, and, with your consent, to understand how the site is used.

• To run the Qualification. We read your request, check it against our criteria, and send you a written yes or a written no with reasons.
• To answer you. If you write to us by email, we process your message to reply to it.
• To keep the site working and secure. Server logs let us find errors and detect abuse. The honeypot field in the form keeps automated submissions out.
• To understand how the site is used. Which pages get read, which do not, and where visitors come from.
• To send you regular email updates about our work. Sending the form is the consent for this, as the note under the button states. You can withdraw at any time, and every such mail carries an unsubscribe link.
• To comply with the law. Where a statutory obligation requires us to keep or hand over data.

We do not use your data for advertising, we do not sell it, and we do not pass it to ad networks or retargeting platforms.

In short: Contract and pre-contractual steps for the form, consent for Google Analytics, legitimate interests for security and cookieless analytics, and legal obligations where they apply.

• Art. 6 (1) (b) GDPR, steps prior to a contract. Everything you enter in the Qualification form, because you ask us for an assessment before a contract exists.
• Art. 6 (1) (a) GDPR, consent. Two things rest on it. Google Analytics and the cookies it sets, additionally under § 25 (1) TDDDG, where nothing loads before you allow it. And the email updates, where sending the form is the consent, as the note under the button states. Both can be withdrawn at any time, with effect for the future.
• Art. 6 (1) (f) GDPR, legitimate interests. Server logs and the secure operation of the site, Vercel Web Analytics because it works without cookies and builds no profile, answering inquiries that do not concern a contract, and the business enrichment of a company record in our CRM so that we can assess a request properly.
• Art. 6 (1) (c) GDPR, legal obligation. Retention where commercial or tax law requires it.

In short: With three processors, each under a data processing agreement, and with nobody else.

Hosting and cookieless analytics. The site runs on Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. We have concluded a data processing agreement under Art. 28 GDPR. Data may be transferred to the United States; Vercel is certified under the EU-US Data Privacy Framework, and the transfer additionally rests on the EU standard contractual clauses.

CRM. Your Qualification request is transmitted server-side to Attio and stored there. Attio is provided by Attio Ltd., 2nd Floor, 42 St John’s Square, London EC1M 4EA, United Kingdom, and stores customer data with Google Cloud EMEA Limited in Ireland. We have concluded a data processing agreement under Art. 28 GDPR. Attio uses sub-processors based in the United States, among them its email delivery provider; those transfers rest on the EU standard contractual clauses.

Analytics, only with your consent. Google Analytics 4 (measurement ID G-FQSXTVLJE8) is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have concluded a data processing agreement under Art. 28 GDPR. Google Analytics shortens IP addresses before they are stored. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-US Data Privacy Framework, and the transfer additionally rests on the EU standard contractual clauses. More in the Google Privacy Policy.

Email. The confirmation you receive after sending the form, and our copy of it, are delivered by Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes your email address, the subject, and the content of that message, and its processing takes place in the United States. We have concluded a data processing agreement under Art. 28 GDPR. Plus Five Five, Inc. is certified under the EU-US Data Privacy Framework, and the transfer additionally rests on the EU standard contractual clauses. Legal basis: Art. 6 (1) (b) GDPR, because the confirmation is part of handling the request you made.

Consent management. The consent banner and the record of your decision are provided by Termly, Inc., 2617 Fifth Ave, San Diego, CA 92103, USA. Termly processes your IP address and the consent you give, in order to show the banner and to document the decision. We have concluded a data processing agreement under Art. 28 GDPR, and the transfer to the United States rests on the EU standard contractual clauses. Legal basis: Art. 6 (1) (c) GDPR, because documenting consent is itself a legal obligation under Art. 7 (1) GDPR.

Business transfers. If the business is sold or merged, your data may pass to the acquirer. We would tell you before that happens.

In short: Only Google Analytics writes to your device for analytics, and only after you allow it. The consent banner itself needs one cookie to work.

Google Analytics sets cookies that recognise a returning visit under a pseudonymous identifier. They expire after 90 days. Hosting, the fonts, the Qualification form, and Vercel Web Analytics all work without cookies, so if you decline, no analytics cookie is stored and no request goes to Google at all.

One cookie is set before you answer, and it stays if you decline: the consent banner sets a security token (“csrf_token”) that it needs in order to display and to record your answer safely. It is strictly necessary for a service you asked for and therefore covered by § 25 (2) no. 2 TDDDG without consent.

The banner and the record of your decision come from Termly. Termly stores your choice in its own cookies on your device so that the question is not asked again on your next visit, and so that we can prove the consent was given. Until you answer, Termly blocks the Google tag on this page; only a yes releases it.

You can change your decision at any time through “Consent Preferences” at the bottom of every page. The withdrawal takes effect from that moment and leaves the processing up to then lawful. Independently of us, you can install the Google Analytics opt-out browser add-on.

In short: As long as the purpose requires, and afterwards only where a statutory retention period applies.

• Qualification requests and email correspondence. Until the request is closed, and after that only for as long as statutory retention periods require.
• Google Analytics. Data retention in our property is set to 14 months. The cookies expire after 90 days.
• Server logs. Kept for a short period for security and error analysis, then deleted by the hosting provider.

In short: Encrypted transport, access limited to the owner, and processors bound under Art. 28 GDPR.

The site is served over TLS, the form is transmitted server-side, and access to the CRM is limited to Mario Schäfer. Each processor is bound by a data processing agreement. No transmission over the internet can be guaranteed to be completely secure, so we cannot promise that no unauthorised third party will ever defeat these measures.

In short: No. This is a business service and it is not directed at children.

We do not knowingly process data from people under 18. If you become aware that a minor has given us data, write to kontakt@nima-labs.de and we will delete it.

In short: Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. One email is enough.

Under Art. 15 to 21 GDPR you have the right to obtain confirmation of whether we process your data and a copy of it, to have inaccurate data corrected, to have your data erased, to have processing restricted, to receive your data in a portable format, and to object to processing based on our legitimate interests.

Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. For Google Analytics, use “Consent Preferences” at the bottom of every page. For the email updates, use the unsubscribe link in any of them, or write to us. The withdrawal takes effect from that moment and leaves the processing up to then lawful.

To exercise a right, write to kontakt@nima-labs.de. We answer within one month.

Complaints. You can complain to a supervisory authority, either the one responsible for us, Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), or the authority in the EU member state where you live or work.

In short: No uniform standard exists, so we do not respond to the signal. The consent banner decides instead.

Most browsers offer a Do-Not-Track setting. No uniform technical standard for handling it has been agreed, so we do not act on it. What decides here is your answer in the consent banner: without a yes, no analytics that needs consent runs at all.

In short: Yes, when the site changes or the law does.

The current version is dated September 2026 and stands at the top of this page. If we make material changes, we will say so on the site.

In short: By email or by post.

Nima Labs
Mario Schäfer
Ringstraße 11
91757 Treuchtlingen
Germany
kontakt@nima-labs.de

The full provider details are on the legal notice.

In short: Ask, and we do it.

Write to kontakt@nima-labs.de and tell us what you want to see, corrected, or deleted. We do not require a form, an account, or a reason.