Legal
Privacy notice
This notice describes the data we use to operate this website, respond to your enquiry and arrange an initial consultation. Optional analytics remains disabled until you give consent.
1. Controller and contact
AD Easytax GmbH
Elisabeth-Breuer-Straße 5
51065 Köln, Germany
Represented by: Mounzir Dalou, Khalil Ali
Phone: 0221 57026995
Email: nik@nuventis.de
Please use these contact details for privacy questions and to exercise your rights. Further provider information is available in our imprint.
Outstanding: contact details of a data protection officer, if appointed.
2. Website access and hosting
Our host, Vercel Inc. (USA), processes connection data needed to deliver and protect this website. This includes IP address, time, requested URL, HTTP status, data volume and browser/device information sent with the request. An incoming request may contain a referrer. Our pages prevent their own addresses from being sent as referrers.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in reliable operation and preventing abuse. Server functions are configured for Frankfurt. This does not establish that all CDN, log, support or storage data remains exclusively in Germany.
Outstanding: Vercel contract and plan, processor terms, actual private Blob storage region and retention periods for access, security and error logs. This draft does not promise automatic short-term deletion of those logs.
3. Contact form, email, phone and WhatsApp
The contact form requires your name and email address. Company, phone and message are optional. It also sends the language and page path, without URL query parameters. The website sends the enquiry through Resend (Plus Five Five, Inc., USA) to nik@nuventis.de. The website code does not create a separate contact database.
When you contact us directly by email or phone, we use the contact details and information you provide to handle your request. Article 6(1)(b) GDPR applies to enquiries concerning a contract with you. For other enquiries and business representatives, Article 6(1)(f) applies; our legitimate interest is handling business communications. Contacting us does not subscribe you to advertising or a newsletter.
Completed enquiries that do not result in a contract are intended to be deleted 90 days after the enquiry is closed, unless further handling, a statutory retention obligation or necessary legal defence requires retention. Statutory periods depend on the document type; this draft does not by itself justify retaining all enquiries for years.
The website offers a link to WhatsApp. Visiting our pages sends nothing to WhatsApp; only when you tap the link does WhatsApp open with a prepared text that you can edit or delete before sending. If you message us on WhatsApp, WhatsApp (WhatsApp Ireland Limited, Ireland, part of the Meta group) processes your phone number, profile name, message content and metadata under its own terms, and transfers to the USA are possible. We only use the message to handle your enquiry. The legal bases are the same as for email and phone (Article 6(1)(b) or (f) GDPR). If you prefer not to use WhatsApp, you can reach us just as well by phone, email, the form or by booking a slot.
Outstanding (WhatsApp): app used (WhatsApp Business or the WhatsApp Business Platform), device, the app's access to the address book (should be blocked), chat retention periods and whether a data processing agreement with Meta is in place.
Outstanding: mailbox provider, applicability and conclusion of the Resend data processing agreement, sending region and Resend retention. The 90-day policy must be implemented for mailboxes and manual files; the website code cannot delete those emails.
4. Appointments and video meetings
To arrange a consultation, we use your name, email, date, time and duration. Company, phone and topic are optional. A booking identifier, creation time and page path support administration. These details are stored in private Vercel Blob storage. The public availability endpoint only returns available times, not participant details.
Resend sends confirmation and cancellation messages to you and our contact person. Messages may include a calendar file and a protected cancellation link. New cancellation links contain neither name nor email address. Keep the link private: anyone who has it can cancel that booking. An optional cancellation reason is emailed to us.
When the Google integration is configured, your name, email, appointment times and a technical booking identifier are sent to Google Calendar to create a Meet appointment. Company, phone and the free-text enquiry are not included in the Google event. Your browser only connects to Google when you follow the Meet link. During a meeting, connection data, display name, audio, video, chat and screen sharing content may be processed according to your use. The website itself has no recording or transcription feature.
The legal bases are Article 6(1)(b) GDPR for steps requested before a contract with you, and Article 6(1)(f) for arranging business meetings with company representatives. Analytics consent is not required. You can also arrange a conversation directly by email or phone.
Deletion from the booking store is prepared for 90 calendar days after the appointment date, through a protected daily cleanup and additionally when the calendar is queried. A successful cancellation immediately removes the Blob booking. If configured, the Google integration also attempts to delete the event. This does not recall delivered emails or copies in recipients’ calendars.
Outstanding: activation and monitoring of the daily cleanup, Resend and Google setup, Google account type, contracting entity and processor terms (normally Google Cloud EMEA Limited, Ireland, for an EEA Workspace contract). Storage locations, international access, 90-day deletion in Google Calendar and mail systems, and meeting/recording settings must be confirmed before use.
5. Preventing automated submissions
Forms use a hidden verification field; bookings also use a timing check. Bounded server memory holds pseudonymous counters derived from IP addresses and, for bookings, email addresses. The counting window is ten minutes. Expired entries are removed on the next check, or when the server instance ends. The application does not persist raw addresses for this purpose and uses no external CAPTCHA service.
The basis is Article 6(1)(f) GDPR and our legitimate interest in preventing spam and abusive bookings. A submission can be temporarily blocked; you can then contact us directly. This is not a decision about entering into a contract.
6. Optional analytics and your choice
Vercel Web Analytics loads only after you select “Allow analytics”. It measures use of public content pages. Data may include time, a cleaned page path, referring page, approximate geographical location and browser, operating system and device type. Vercel receives connection data including an IP address during transmission. According to Vercel, visitors are distinguished using a hash derived from the request, discarded after 24 hours. This is not a deletion period for all statistics.
We do not send form content as analytics events. Query parameters and fragments are removed from the measured page address. Cancellation and legal pages are excluded. Analytics uses no advertising cookies.
The bases are Article 6(1)(a) GDPR and, insofar as device information is accessed, section 25(1) TDDDG. Without consent and after rejection, the analytics script stays disabled. Your choice is stored locally under nuventis:privacy:v1: allow or decline, timestamp and notice version, without an additional user identifier. It is valid for 180 days and discarded on the next visit after expiry. This storage only serves to respect your choice (section 25(2)(2) TDDDG; Article 6(1)(f) GDPR).
Use “Privacy settings” in the footer of every page to change your choice. While analytics is allowed, the footer also shows “Withdraw analytics consent”, which ends consent with one click and reloads the page. Withdrawal applies to future processing and does not affect the lawfulness of earlier processing or retroactively delete transmitted statistics. Your choice applies to this browser on this device; other browsers and devices maintain separate choices.
Outstanding: analytics retention in the actual Vercel plan, contract and transfer grounds, and appropriate evidence of consent for this use. The website stores the choice locally and does not maintain a central consent register.
6a. Conversion measurement for Google Ads
We place ads with Google Ads. To find out whether an ad leads to someone contacting us, we use Google Ads conversion tracking with your consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
The Google tag (gtag.js) is only loaded after you select “Ad measurement” in the privacy settings or click “Allow all”, and only on our public content pages, not on legal pages or cancellation pages. Your browser then connects to Google servers (including www.googletagmanager.com). We report the following events to Google as conversions: an enquiry sent successfully, an appointment booked successfully, a click on a WhatsApp link or a click on a phone number. We do not send form contents such as your name, email address, phone number or message.
Google processes in particular your IP address, browser and device information, the address of the page including a click identifier from the ad (gclid), and the time and type of the event. The tag stores cookies in your browser (such as _gcl_au and, after an ad click, _gcl_aw) so that an ad click can be matched to a later enquiry. Google may also read or set cookies on its own domains. In Google Ads we only see aggregated figures, such as how many enquiries followed ad clicks.
We use Google’s consent mode (Consent Mode, version 2). All consent signals start as “denied”. Only with your consent do we set ad_storage (storing advertising cookies) and ad_user_data (sending user data for advertising purposes) to “granted”. ad_personalization and analytics_storage stay denied: we do not use the measurement for personalised advertising or remarketing, and we do not use Google Analytics.
The legal basis is your consent under Article 6(1)(a) GDPR and, for storing and reading information on your device, Section 25(1) TDDDG. Consent is voluntary and separate from analytics; you can use the website fully without it. Your choice is stored together with the analytics choice under nuventis:privacy:v1 (section 6) and is likewise valid for 180 days.
Google Ireland Limited may transfer personal data to Google LLC in the USA. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework, Article 45 GDPR); it covers recipients certified under this framework. You can check the certification in the list at dataprivacyframework.gov.
You can change your choice at any time via “Privacy settings” in the footer of every page. While ad measurement is allowed, the footer also shows “Withdraw ad measurement consent”; one click ends your consent. The page then reloads, the Google tag is no longer loaded, and the website removes the cookies named above from your browser. Withdrawal takes effect for the future; data already sent to Google is not deleted by it.
According to Google, the Google tag’s cookies usually expire after 90 days. How long Google itself keeps the data it receives is determined by Google; details are in Google’s privacy policy and in “How Google uses information from sites or apps that use our services”.
7. Fonts, media and external links
Fonts, images, project videos and rendering libraries are delivered through this website. No Google Fonts requests, maps, YouTube players or social media plugins are loaded; the Google tag for Google Ads loads only after your consent (section 6a). Client and project links open third-party sites only when followed. Their own privacy notices apply.
8. Recipients and international processing
Recipients include authorised personnel at the provider, Vercel for hosting and booking storage and, depending on use and setup, Resend, the mailbox provider and Google. Analytics reaches Vercel only after consent. Processing or access outside the EU/EEA is possible, particularly with US providers. A European server region does not exclude this.
The actual Article 28 GDPR processor agreements and the basis of each international transfer must be recorded before finalising this notice. Possible grounds are Article 45 where the recipient is verified as currently certified and covered by the EU-US Data Privacy Framework, or Article 46 standard contractual clauses with the required assessment and any supplementary measures. This draft confirms neither executed contracts nor specific certifications. Once clarified, details and copies of the safeguards used can be requested through our privacy contact.
9. Your rights
Subject to the statutory conditions, you may request access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability for automated processing based on consent or contract (Article 20).
Objection: You may object to processing based on Article 6(1)(f) on grounds relating to your particular situation (Article 21). For direct marketing, the right to object applies at any time without giving reasons. Consent can be withdrawn for the future at any time; for analytics, use the button described above.
Contact nik@nuventis.de to exercise your rights. You may complain to a supervisory authority, particularly where you usually live, work or believe a violation occurred (Article 77). For our registered office in Cologne, the local authority is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information.
10. Providing data and automated decisions
You are not required to use these forms. Without a name and email, we cannot process the form request or confirm the booking. Other fields and analytics consent are optional. The website code contains no automated decision with legal or similarly significant effects under Article 22 GDPR or profiling for that purpose.
The published website uses HTTPS. We update this notice when services or processing activities change.