Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

NexRole Solution GbR, represented by its partners Gonas Panneerselvam and Domenik Sasa Petranovic

Magdeburger Ring 50 C, 76344 Eggenstein-Leopoldshafen, Germany

Email: privacy@nexrolesolution.com · Phone: +49 176 56005148

We have not appointed a data protection officer, as the statutory thresholds for doing so are not met. Please direct data protection enquiries to the address above.

2. Principles

We process personal data only where necessary to provide a functioning website and our content and services, or where you have given consent.

We do not sell data, do not profile for advertising purposes, and use no analytics or advertising cookies.

3. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Server function execution is pinned to the Frankfurt am Main region (fra1), so processing regularly takes place within the European Union.

A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. As it is a US company, access from a third country cannot be entirely excluded. The transfer is based on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure, performant and reliable provision of this website.

4. Server log files

When you access this website, information transmitted by your browser is automatically recorded in server log files: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and the IP address.

This data is not merged with other data sources. The legal basis is Art. 6 (1) (f) GDPR. The legitimate interest is the secure, stable and abuse-free operation of the website.

Log data is deleted after 14 days at the latest, unless it is exceptionally needed for longer to investigate a specific case of abuse.

5. Contact form and email

If you send us an enquiry via the contact form or by email, we process your name, contact details, company (if given), the stated subject and the content of your message solely in order to handle your enquiry.

The legal basis is Art. 6 (1) (b) GDPR where the enquiry is directed at concluding a contract, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries).

Enquiries sent through the website forms are stored in our database (Neon, EU region Frankfurt am Main) so that none is lost, and are additionally delivered to us by email where email delivery is configured. We delete stored enquiries after 12 months at the latest, unless a contract results from them or statutory retention obligations apply.

For email delivery we use Resend Inc., 2261 Market Street, San Francisco, CA 94114, USA, as a processor. The transfer is based on the European Commission's standard contractual clauses.

6. The AI consultant Nex and the idea planner

This website offers an AI assistant and an AI-supported project planner. Your input is sent to our server and forwarded from there to our language model provider in order to generate an answer. The provider is Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA.

Only the text you type and the conversation history your browser sends along are processed. We do not transmit your name or your IP address to the provider.

Please do not enter passwords, payment data, health data or other sensitive personal data into the assistant. It does not need such information.

Your input is not used to train language models. The provider is contractually bound to process the data solely to deliver the service. A data processing agreement pursuant to Art. 28 GDPR is in place, and the transfer to the USA is based on the European Commission's standard contractual clauses.

We do not store conversations permanently. We retain only anonymous aggregated counters covering the number of requests, error rates and abuse signals, plus, where abuse is detected, a shortened and hashed IP address for security purposes.

The legal basis is Art. 6 (1) (f) GDPR. The legitimate interest is offering prospective clients an immediate first answer and protecting the service against misuse. Using the assistant is voluntary; the website is fully usable without it.

No automated decision-making producing legal effects concerning you within the meaning of Art. 22 GDPR takes place. The assistant's output is a non-binding indication and not an offer.

7. Abuse protection

To protect the contact form and the AI assistant against automated access, we limit the number of requests per connection. To do so we derive a salted, non-reversible hash from your IP address and hold short-lived counters in the server's memory. The IP address itself is not stored for this purpose.

Where enabled, we additionally use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, for bot detection. Turnstile operates without behavioural profiles and without advertising cookies.

The legal basis is Art. 6 (1) (f) GDPR. The legitimate interest is defending against spam and automated abuse.

8. Fonts

The fonts used on this website are served exclusively from our own server. No connection is made to Google Fonts or any other external font provider. Your IP address is not transmitted to third parties for this purpose.

9. Cookies, local storage and website statistics

Necessary storage (no consent required under § 25 (2) no. 2 TDDDG): the cookie NEXT_LOCALE holds your language preference for one year; the cookie nx_consent stores your cookie choice for six months.

Anonymous statistics (everyone): when you open a page, we record the page, the time, the country and region that our host derives from your IP address, the domain of the website that referred you and the device type (desktop, mobile or tablet). Your IP address itself is not stored, no identifier is created and nothing is stored on or read from your device. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in knowing how our website is used. These records are deleted after 13 months.

Statistics (only with your consent): we additionally store your full IP address, city, browser details (user agent) and a random visitor ID that is kept in your browser's local storage (nx_vid), so we can see which pages a returning visitor reads and from which regions our visitors come. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. IP address, city, browser details and visitor ID are deleted automatically after 30 days.

Marketing (only with your consent and only when the respective service is active): the Google tag (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) measure which of our ads lead to visits and enquiries. These providers set their own cookies and may transfer data to the USA. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

You can change or withdraw your choice at any time with effect for the future via Cookie settings at the bottom of every page. The website works fully whichever option you choose.

10. Recipients and processors

Your data is passed to third parties only where necessary to perform a contract, where we are legally obliged to do so, or where you have consented.

We use the following processors under Art. 28 GDPR: Vercel Inc. (hosting), Neon Inc. (database, EU region Frankfurt am Main), Anthropic PBC (language model), Resend Inc. (email delivery) and, where enabled, Cloudflare, Inc. (bot protection). With your marketing consent, Google Ireland Limited and Meta Platforms Ireland Limited receive data as described in section 9.

A current list of the processors in use is available on request from the address given in section 1.

11. Transfers to third countries

Where processing takes place outside the European Economic Area, it is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) for certified providers, or on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, supplemented by additional safeguards such as transport encryption and data minimisation.

12. Your rights

You have the right at any time to information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20 GDPR).

You have the right to object, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

A message to privacy@nexrolesolution.com is enough to exercise these rights.

13. Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany.

14. Data security

This website is delivered exclusively over TLS. In addition we apply a strict content security policy, per-connection request limits and filtering of the AI assistant's input and output to protect the site and its users.

15. Changes to this policy

We update this privacy policy whenever changes to our services or to the legal situation make it necessary. The version available at the time of your visit applies.