Privacy Policy

We operate our websites in accordance with the principles set out below:

We are committed to complying with statutory data protection requirements and endeavour to observe the principles of avoiding unnecessary data collection and minimising the data we process at all times.

Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the Member States of the European Union and other applicable data protection provisions is:

Nakatanenga 4x4 Equipment GmbH & Co. KG
Ludwig-Erhard-Ring 30
92348 Berg bei Neumarkt i.d.OPf.
Germany
Telephone: +49 9181 466 644
Fax: +49 9181 407 760
Email: datenschutz@nakatanenga.de
Website: www.nakatanenga.de

Definitions

We have drafted this Privacy Policy with clarity and transparency in mind. If any of the terminology used remains unclear, the relevant definitions can be found here in Article 4 GDPR.

Legal basis for processing data

Processing personal data under the GDPR

We process your personal data, such as your first name and surname, email address and IP address, only where there is a legal basis for doing so. In particular, the following provisions of the GDPR may apply:

Article 6(1), first subparagraph, point (a) GDPR: The data subject has given consent to the processing of their personal data for one or more specific purposes.
Article 6(1), first subparagraph, point (b) GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject's request prior to entering into a contract.
Article 6(1), first subparagraph, point (c) GDPR: Processing is necessary for compliance with a legal obligation to which the controller is subject.
Article 6(1), first subparagraph, point (d) GDPR: Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
Article 6(1), first subparagraph, point (e) GDPR: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Article 6(1), first subparagraph, point (f) GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

We also specify the legal basis for processing your personal data in each relevant section of this Privacy Policy.

Authorisation by the holder of parental responsibility under Article 8(1), second sentence, second alternative GDPR

Where processing on this website requires the consent of a child under the age of 16, the holder of parental responsibility must authorise that processing.

This Privacy Policy provides information about the individual processing activities, their purposes and the categories of data concerned where the data subject's consent is required.

You may withdraw your consent at any time by sending a notice of withdrawal in text form to the controller using the contact details provided above. Processing carried out before withdrawal remains lawful.

Processing information under section 25(1) TDDDG

We also process information under section 25(1) of the German Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), the law governing data protection and privacy in telecommunications and digital services, by storing information on your terminal equipment or accessing information already stored on it. This may involve both personal and non-personal data, such as cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. Terminal equipment means any equipment connected directly or indirectly to the interface of a public telecommunications network for sending, processing or receiving messages, as defined in section 2(2), point 6 TDDDG.

As a rule, we process this information on the basis of your consent under section 25(1) TDDDG.

We do not require consent where an exception under section 25(2), point 1 or point 2 TDDDG applies. Such an exception applies where we access or store information solely to transmit a message over a public telecommunications network, or where this is strictly necessary to provide a digital service expressly requested by you. You may withdraw your consent at any time.

Please note that withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Disclosure of personal data

Disclosure of personal data also constitutes processing as described in the section entitled “Legal basis for processing data”. However, we would like to provide separate information here about disclosure to third parties. Protecting your personal data is very important to us. We therefore take particular care when disclosing your data to third parties.

We disclose data to third parties only where there is a legal basis for the processing. For example, we disclose personal data to individuals or companies acting as processors on our behalf under Article 28 GDPR. A processor is anyone who processes personal data on our behalf, in particular subject to our instructions and supervision.

In accordance with the GDPR, we enter into an agreement with each of our processors requiring them to comply with data protection provisions and thereby providing comprehensive protection for your data.

Retention periods and erasure

We erase your personal data when it is no longer necessary for the purposes for which it was collected or otherwise processed, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

SSL or TLS encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as enquiries you send to us as the website operator. You can recognise an encrypted connection by the change from “http://” to “https://” in your browser's address bar and by the padlock symbol in the browser bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Use of artificial intelligence (AI) systems

To optimise our processes and improve your personalised experience when visiting our website, your personal data may be processed using artificial intelligence (AI) technologies. In particular, AI is used to:

analyse data;
make predictions;
address security vulnerabilities; and
make routine processes more efficient.

The AI systems we use operate in accordance with the principles of the GDPR. Any decisions that have legal or similar effects on you are not made solely by AI, but also involve human intervention.

Cookies

We use cookies on our website. Cookies are small data files that your browser creates automatically and stores on your device when you visit our website. They store information relating to the device you are using.

We distinguish between strictly necessary cookies and other cookies. Cookies are strictly necessary where they are essential to provide an information society service expressly requested by you.

Strictly necessary cookies

To make our services easier to use, we use strictly necessary cookies. These may include session cookies, for example for language and font settings or the shopping basket, consent cookies, cookies that ensure server stability and security, and similar cookies. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in the error-free operation of the website and in providing you with optimised services.

Other cookies

Other cookies include cookies used for statistical, analytical, marketing and retargeting purposes.

We use these cookies on the basis of your consent under Article 6(1)(a) GDPR.

You may withdraw your consent to the use of cookies at any time.

Please note that withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To do so, you can change your cookie settings on our website, disable cookies in your browser settings, which may limit the functionality of our online services, or use an opt-out for the particular service where available.

We specify the legal basis for processing data in the sections of this Privacy Policy relating to the individual services.

Cookie banner and consent management

To obtain consent for the cookies we use, we use the cookie banner provided by Shopware AG, Ebbinghoff 10, 48624 Schöppingen. The banner itself sets a consent cookie to retrieve and process the respective consent status. This consent cookie is strictly necessary to store and honour your consent decision. Information is stored and accessed on the basis of section 25(2), point 2 TDDDG. To the extent that personal data is processed, this is based on our legitimate interest in properly managing your consent under Article 6(1)(f) GDPR.

For certain services provided by the Google/Alphabet group, we use Google Consent Mode v2 in basic mode. Details of this consent mode are available on Google's website at https://developers.google.com/tag-platform/security/guides/consent?hl=de&consentmode=advanced.

The use of Consent Mode is technically necessary and is therefore based on our legitimate interest under Article 6(1)(f) GDPR.

Collection and storage of personal data: nature and purposes of use

External hosting

Our website is hosted by IP-Projects GmbH & Co. KG, Am Vogelherd 14, 97295 Waldbrunn, Germany. All personal data collected on our website is therefore stored on our hosting provider's servers, unless an external third-party service is integrated. This may include your IP address, email address, communications data or similar information. The specific personal data involved is described below for each individual function and service. Where we use an external third-party service, this is indicated in the description of that service or tool.

The hosting provider processes your data only on our instructions and to the extent necessary to provide the services on the website. The hosting provider does not process the data for its own purposes. We have entered into a data processing agreement with the provider.

When you visit the website

When you access our website, the browser on your device automatically sends information to our website's server. This information is temporarily stored in a log file. The following information is collected without any action on your part and stored until it is automatically erased:

IP address of the requesting computer;
date and time of access;
name and URL of the file accessed;
website from which access originated (referrer URL);
browser used and, where applicable, your computer's operating system and the name of your internet access provider.

We process this data for the following purposes:

ensuring that a connection to the website can be established smoothly;
ensuring convenient use of the website;
evaluating system security and stability;
analysing errors;
other administrative purposes.

Data that could identify you, such as your IP address, is erased after no more than seven days. If we retain data beyond this period, it is pseudonymised so that it can no longer be linked to you.

The legal basis for processing is Article 6(1)(f) GDPR. Our legitimate interest arises from the purposes of data collection listed above. We never use the data collected for the purpose of identifying you.

Online shop system

We use the online shop system provided by Shopware AG, Ebbinghoff 10, 48624 Schöppingen, to offer our goods.

The data you provide is therefore also processed by our shop system provider as part of operating the shop system. The shop system may also set additional cookies.

We have therefore entered into a data processing agreement with the provider.

Further information about data protection is available at: https://www.shopware.com/de/datenschutz/website/.

Contractual relationship

Entering into a contract

When establishing a contractual relationship, we process only the personal data strictly necessary to perform the contract, in accordance with Article 6(1)(b) GDPR.

Any additional information you provide voluntarily is processed only on the basis of your consent under Article 6(1)(a) GDPR. We use this voluntary information to provide a customer-friendly service and continually improve it.

Customer account

You can create a customer account with us. In addition to the personal data needed to perform the contract, we store and process any further information you provide voluntarily and details of your previous purchases from us. You can access these details at any time to view your purchase history. This data allows you to sign in easily with your login details the next time you shop. It is also intended to help you manage your purchases.

The legal basis is your consent under Article 6(1)(a) GDPR.

You can amend or erase the data in your customer account at any time and delete the account in its entirety. When your customer account is deleted, we erase the associated personal data unless statutory retention obligations prevent us from doing so. Data subject to retention obligations, in particular certain order and invoice data, is retained for the statutory period and then erased.

Disclosure of data for shipping

We disclose the data necessary to ship our goods (first name and surname, address, email address and, where required for goods shipped by a freight forwarder, telephone number) to the relevant shipping provider to notify you about or coordinate delivery and to deliver the goods.

The legal basis for this disclosure is Article 6(1)(b) GDPR.

In this context, we disclose your data to one of the following shipping providers. You can obtain further information about the processing of your data from the relevant provider:

DHL

DHL Paket GmbH
Charles-de-Gaulle-Straße 20
53113 Bonn
Germany
Telephone: +49 228 1820
Email: paket-anfrage@dhl.com
Privacy policy: https://www.dhl.de/de/toolbar/footer/datenschutz.html

DHL Express

DHL Express Germany GmbH
Heinrich-Brüning-Straße 5
53113 Bonn
Germany
Email: datenschutz@dhl.com
Privacy policy: https://www.dhl.de/de/toolbar/footer/datenschutz.html

GLS

General Logistics Systems Germany GmbH & Co. OHG
GLS Germany-Straße 1–7
36286 Neuenstein
Germany
Telephone: +49 6677 646907000
Email: service@gls-germany.com
Privacy policy: https://gls-group.eu/DE/de/datenschutz-standard/

Gebrüder Weiss Spedition

Gebrüder Weiss GmbH
Karatas-Straße 6
87700 Memmingen
Germany
Telephone: +49 8331 49825-0
Email: service.memmingen@gw-world.com
Privacy policy: https://www.gw-world.com/de/datenschutzhinweis

DSV (Freight Forwarding, Road Transport)

Schenker Deutschland AG (DSV Group)
Schlachte 15–18
28195 Bremen
Germany
Telephone: +49 421 1768-0
Email: info.road@de.dsv.com
Privacy policy: https://www.dsv.com/de-de/ueber-dsv/datenschutzerklaerung/datenschutzerklaerung-de

DSV Parcel (Express, Air & Sea)

DSV Air & Sea Germany GmbH
Schlachte 15–18
28195 Bremen
Germany
Telephone: +49 421 1768-0
Email: parcel.info@de.dsv.com
Privacy policy: https://www.dsv.com/de-de/ueber-dsv/datenschutzerklaerung/datenschutzerklaerung-de

Disclosure of data when using online payment service providers

If you choose to pay using one of the online payment service providers we offer during checkout, your contact details will be transmitted to that provider as part of the resulting order. The legal basis for disclosing the data is Article 6(1)(b) GDPR, to process the payment method you have selected, and our legitimate interest under Article 6(1)(f) GDPR in facilitating user-friendly, straightforward payment processing.

The personal data transmitted to the online payment service provider generally includes your first name, surname, address, telephone number, IP address, email address and other data required to process the order, as well as order-related data such as item quantities, item numbers, invoice amount, tax rates and billing information.

This transmission is necessary to process your order using your chosen payment method, in particular to verify your identity and administer your payment and the customer relationship.

Please note that the online payment service provider may also disclose personal data to service providers, subcontractors or other affiliated companies where this is necessary to fulfil the contractual obligations arising from your order or where personal data is to be processed on its behalf.

Depending on the payment method selected, such as payment on account or direct debit, the provider will transmit the personal data it receives to credit reference agencies. This transmission is used to carry out identity and creditworthiness checks in connection with your order. Details of the credit reference agencies involved and the data generally collected, processed, stored and disclosed by each provider can be found in the providers' respective privacy policies:

PayPal

PayPal (Europe) S.à.r.l. & Cie. S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg
Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Credit card payments

If you choose to pay by credit card, we collect and process the personal data necessary for that purpose and forward it to the card issuer to process the payment and comply with statutory requirements, such as customer authentication under the EU Payment Services Directive (PSD2).

This data is forwarded to process your payment under Article 6(1)(b) GDPR and to fulfil our statutory obligation to carry out strong customer authentication under Article 6(1)(c) GDPR in conjunction with Directive (EU) 2015/2366 (PSD2) or the German Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – ZAG), for anti-money laundering and law enforcement purposes.

The technical processing of credit card payments is handled by the payment service provider PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. This provider has been engaged under Article 28 GDPR to manage the technical aspects of payment transactions, including the 3D Secure 2.0 procedure. Other recipients of the data are the banks involved: the card-issuing bank (the issuer) and the merchant's card-accepting bank (the acquirer).

PayPal's privacy policy is available at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Inventory and order management system

To perform our contracts, we use the inventory and order management system Lexware Warenwirtschaft Pro, provided by Haufe Group SE, a European Company (Societas Europaea, SE) with its registered office in Freiburg, at Munzinger Straße 9, 79111 Freiburg im Breisgau.

Your personal data is processed to perform our contract with you, on the basis of Article 6(1)(b) GDPR.

IT service provider for the inventory and order management system

We use AIH Service GmbH, Kastanienweg 3, 86573 Obergriesbach, for technical support and maintenance of our inventory and order management system.

Your name, address, email address, telephone number and order data are processed to the extent necessary for technical support and troubleshooting of the system.

Your personal data is processed to perform our contract with you, on the basis of Article 6(1)(b) GDPR.

We have entered into a data processing agreement with AIH Service GmbH under Article 28 GDPR.

Further information is available at: https://www.aih.de/

Oscware (integration tool)

To transfer order data between our online shop (Shopware) and our inventory and order management system (Lexware), we use the cloud service Oscware, provided by NetIntegrations GmbH, Jesinger Straße 52, 73230 Kirchheim.

Your name, address, email address, telephone number (optional) and order data are processed to transfer order information automatically for order fulfilment.

Your personal data is processed to perform our contract with you, on the basis of Article 6(1)(b) GDPR.

We have entered into a data processing agreement with NetIntegrations GmbH under Article 28 GDPR.

Further information: https://www.oscware.de/

Newsletter content and subscription details

We send our newsletter, carry out statistical measurements and analyses, and log the subscription process only if you subscribe to the newsletter and give the relevant consent under Article 6(1)(a) GDPR and section 25(1) TDDDG.

The content of the newsletter is described specifically when you subscribe. Your email address is sufficient to subscribe. If you voluntarily provide additional information, such as your name and/or gender, it is used solely to personalise the newsletter addressed to you.

Double opt-in and logging

For security reasons, we use a double opt-in procedure for newsletter subscriptions to prevent anyone from subscribing using someone else's email address. After subscribing, you will first receive an email asking you to confirm your subscription. Your subscription becomes effective only once you have confirmed it.

We also log your newsletter subscription. This includes storing the times of subscription and confirmation, the data you provided and your IP address. Any changes you make to your data are also logged.

Withdrawal of consent

If you no longer wish to receive our newsletter, you may withdraw your consent at any time with effect for the future. You can do so by clicking the unsubscribe link at the end of each newsletter or by sending an email to: datenschutz@nakatanenga.de

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Use of CleverReach

We use the email tool CleverReach (CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany) to send our newsletter.

For this purpose, the data you provide is disclosed to and processed by CleverReach. This tool allows us to analyse how newsletters are opened and used.

We have entered into a data processing agreement with CleverReach.

Further information about data protection at CleverReach is available at: https://www.cleverreach.com/de-de/datenschutz/.

Contact form

We provide a form on our website that you can use to contact us at any time. To use the contact form, you must provide a name so that we can address you personally and a valid email address so that we can contact you, identify who sent the enquiry and respond to it.

If you send us an enquiry using the contact form, the information you enter, including the contact details you provide and your IP address, is processed under Article 6(1)(b) and (f) GDPR to take steps at your request prior to entering into a contract or to pursue our legitimate interest in conducting our business.

We retain your enquiry and the associated personal data for as long as necessary to deal with your request and any necessary follow-up enquiries. Enquiries that do not result in a contract are erased no later than twelve months after we have finished dealing with them, unless the data is no longer needed earlier. Where further retention is necessary for the establishment, exercise or defence of legal claims, or where statutory retention obligations apply, we retain the data necessary for those purposes for the relevant period.

Biloba IT chatbot with AI functionality

We use an AI-based chatbot on our website, integrated by Biloba IT Balleyer & Lohrmann GbR, Heilbronner Straße 9, 73728 Esslingen, Germany (“Biloba IT”), to answer your product enquiries and questions more quickly and efficiently.

The chatbot provides automated advice about our product catalogue and services and uses the API of OpenAI Inc., 3180 18th Street, San Francisco, CA 94110, USA.

When you interact with the chatbot, Biloba IT stores your IP address, the timestamp of your request, technical information (browser type and operating system) and your inputs (for example, product enquiries and questions) on our behalf. This data is transmitted to the OpenAI API and processed there to provide the service and generate appropriate responses. The chatbot has access only to information about our product range and services, and has no access to customer or order data.
Your inputs are not used to train OpenAI's AI models.

The legal basis for processing is your prior consent under Article 6(1)(a) GDPR. You may withdraw this consent at any time by emailing datenschutz@nakatanenga.de. Processing of your data remains lawful until we receive your withdrawal.

We have entered into a data processing agreement with Biloba IT under Article 28 GDPR. We have also entered into a Data Processing Addendum (DPA) with OpenAI governing the data protection obligations under the GDPR.

Further information about data protection at Biloba IT is available at https://www.biloba-it.de/datenschutz/ and at OpenAI at https://openai.com/policies/data-processing-addendum/.

Use of Google Maps

An interactive map from Google Maps is embedded on a subpage of our website. It allows you to see our location and plan your visit.

For users in the EU/EEA, this service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The service is part of Google Maps Platform.

The map is loaded on our website only after you actively consent (a “two-click solution”). A connection to Google Maps Platform servers is established only when you click the map. Your IP address and technical information about your browser, including browser type and version, operating system and referrer URL, are then transmitted to Google. When the map service is integrated, cookies and similar storage technologies may also be placed on or accessed on your device. Please note that we have no control over Google's further processing of data within its own services.

As Google LLC is based in the USA, personal data may be transferred to the United States when you use Google Maps.

The integration of Google Maps and the associated placement of cookies on your device are based exclusively on your consent under section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR, which you give by actively clicking the map. You may withdraw your consent at any time with effect for the future by reloading the page without reactivating the map and by deleting the cookies stored in your browser.

Google Maps Platform operates on a controller-to-controller basis. Google processes the transmitted data as an independent controller under its own privacy policy; a data processing agreement under Article 28 GDPR cannot be entered into with Google for this service. The basis for data transfers compliant with data protection requirements is the Google Controller-Controller Data Protection Terms applicable to Google Maps Platform, including the Standard Contractual Clauses (SCCs) contained in them.

Further information about Google's processing of data is available in Google's Privacy Policy at https://policies.google.com/privacy and in the Google Controller-Controller Data Protection Terms applicable to Google Maps Platform at https://business.safety.google/controllerterms/.

Embedding Google Maps also causes Google Fonts to be loaded dynamically, without the website operator or visitor actively choosing this. These web fonts are loaded through a server request, usually to a Google server in the USA. The following information may be transmitted to that server and stored by Google:

name and version of the browser used;
website from which the request originated (referrer URL);
your computer's operating system;
your computer's screen resolution;
IP address of the requesting computer;
language settings of the browser or operating system you use.

Further information can be found in Google's privacy information, available at: www.google.com/policies/privacy/

Address autocomplete (Google Places API)

We use an address autocomplete feature on our website. As soon as you start typing an address in the relevant input field, matching address suggestions (street, house number, town or city and postcode) are displayed in real time to help you enter a correct and complete address.

To provide address suggestions, the text you enter (address fragments) and your IP address are transmitted to Google Maps Platform servers. Google also uses your IP address to give approximate geographical weighting to the suggestions. When the associated script is integrated, cookies and similar storage technologies may also be placed on or accessed on your device. This may establish a connection to the Google network and allow your activity to be tracked across different websites. We have no control over Google's further processing of data within its own services.

As Google LLC is based in the USA, personal data may be transferred to the United States when you use this service.

The integration of this service and the associated placement of cookies on your device are based exclusively on your consent under section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by changing your cookie settings.

Google Maps Platform operates on a controller-to-controller basis. Google processes the transmitted data as an independent controller under its own privacy policy. A data processing agreement under Article 28 GDPR cannot be entered into with Google for this service. The basis for data transfers compliant with data protection requirements is the Google Controller-Controller Data Protection Terms applicable to Google Maps Platform, including the Standard Contractual Clauses (SCCs) contained in them.

Google Tag Manager

We use Google Tag Manager on our website, provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager is an administration and management tool that allows other tracking and/or statistical tools to be managed and deployed centrally.

When you visit our website, Google Tag Manager collects and processes your IP address, which may also be transferred to the USA. However, Google Tag Manager does not itself create user profiles or carry out analyses.

Google Tag Manager is used on the basis of your consent under Article 6(1)(a) GDPR.

We have entered into a data processing agreement with Google.

Google's Privacy Policy is available here. [https://www.google.com/policies/privacy/?hl=de]

Use of ALTCHA

To protect our forms against spam and automated access, we use ALTCHA, a self-hosted open-source solution provided by BAU Software s.r.o., Lidicka 700/19, Brno 602 00, Czechia. ALTCHA does not use cookies or fingerprinting and does not transmit data to third parties. Processing takes place exclusively locally on our server. The legal basis is our legitimate interest in the security of our online services under Article 6(1)(f) GDPR.

Analytics and tracking tools

We use the analytics and tracking tools listed below on our website. These tools help us continually optimise the website and tailor it to users' needs.

We use these tools on the basis of your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time by changing your cookie settings. Processing carried out before withdrawal remains lawful.

The respective processing purposes and data categories are described for each tool. Please note that we have no control over whether, or to what extent, the service providers carry out further processing of data.

Google Analytics

We use Google Analytics on our website, a web analytics service provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).

Google Analytics uses cookies for this purpose (see the “Cookies” section). The information generated by the cookie about your use of this website, such as

name and version of the browser used;
your computer's operating system;
website from which access originated (referrer URL);
IP address of the requesting computer;
time of the server request;

is generally transmitted to a Google server in the USA and stored there.

Your IP address is automatically anonymised by Google before it is recorded via EU domains and servers. Your IP address is therefore not logged or stored.

Google uses this information on our behalf to evaluate your use of our website, compile reports on website activity and provide us with other services relating to website and internet use. The IP address transmitted by your browser through Google Analytics is not combined with other data held by Google.

We have entered into a data processing agreement with Google.

For an overview of privacy and data protection at Google, please visit: https://support.google.com/analytics/answer/6004245

Google Remarketing

We use Google Analytics' remarketing feature to target advertising campaigns, including Google AdWords campaigns, at visitors to our website.

Based on your previous visits to our website, relevant advertisements are shown to you when you visit other websites within the Google Display Network.

The DoubleClick cookie enables Google, us and other third-party providers to display targeted advertisements matching interests inferred from your previous visits to our website and/or other websites. These advertisements may appear on Google's websites or those of other operators within Google's advertising network. We also use Google Analytics advertising features to analyse the effectiveness of our own advertising campaigns.

If you have agreed in your Google account that Google may associate your web and app browsing history with your Google account and use information from your Google account to personalise advertisements, Google uses your data together with Google Analytics data to create audience lists for cross-device remarketing. To do this, Google Analytics first collects Google-authenticated IDs associated with your Google account when you use our website. Google Analytics then temporarily links these IDs with Google Analytics data to optimise our audiences.

We have entered into a data processing agreement with Google.

For an overview of privacy and data protection at Google, please visit: https://support.google.com/analytics/answer/6004245

Google Ads conversion tracking

We use Google Ads on our website, an online advertising programme provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This includes conversion tracking. Through this tool, Google Ads places a cookie on your device when you reach our website via a Google advertisement.

The cookie is not used to identify you personally. If you visit our website while the cookie is still active, we and Google can recognise that you clicked the relevant advertisement and were redirected to our website. Each Google Ads customer is assigned a different cookie, so cookies cannot be tracked across the websites of different Ads customers.

The data collected through conversion cookies is used to generate conversion statistics for Ads customers. As a Google Ads customer, we learn the total number of users who responded to our advertisement and were then directed to a website containing a conversion tracking tag. This allows us to measure the success of individual advertising activities. We do not receive any information in this process that would allow us to identify you personally.

When Google Ads is used, your browser automatically establishes a direct connection to Google's server. If you have a Google account and are signed in, Google can associate your visit with your account. If you do not have a Google account, Google assigns you a separate identifier. We have no control over what additional data Google collects and stores.

We have implemented Google's “enhanced conversions” feature on our website. This captures data we have collected directly, such as email address, name, address or telephone number, in conversion tracking tags. The data is then sent to Google in hashed form, where it is used to match our existing customers to Google accounts. Further information about this feature is available at https://ads.google.com/intl/de_de/home/privacy/solutions/enhanced-conversions-for-web/

We have entered into a data processing agreement with Google.

Further information about Google's privacy policy is available at http://www.google.de/policies/privacy/.

Microsoft Clarity

We use the analytics service Microsoft Clarity on our website, provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

Usage-related and user-related information, such as your IP address, location, the time of your visit and how frequently you visit our website, is transmitted to a Microsoft server in the USA and stored there. We have enabled Microsoft's anonymisation feature so that your IP address is processed only in truncated form.

This data is used to analyse your visit to our website and your usage behaviour so that we can improve and optimise our services.

We have agreed Standard Contractual Clauses with Microsoft. Further information about Microsoft's privacy practices is available at: https://privacy.microsoft.com/de-de/privacystatement.

Embedding images, audio and video – YouTube

We embed YouTube videos on our website using an iframe and/or a plugin. YouTube is operated by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We have enabled YouTube's privacy-enhanced mode for the embedded videos.

If you play a YouTube video during your visit, a connection to YouTube's servers is established and the YouTube server is informed which of our pages you have visited. This allows YouTube to associate your browsing behaviour directly with your personal profile. You can prevent this by signing out of your account before visiting our website. YouTube also sets various cookies when the service starts, which it states are used to improve its services and prevent misuse.

Further information about the handling of user data and the cookies used is available in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy

Embedding YouTube also causes Google Fonts to be loaded dynamically, without the website operator or visitor actively choosing this. These web fonts are loaded through a server request, usually to a Google server in the USA. The following information may be transmitted to that server and stored by Google:

name and version of the browser used;
website from which the request originated (referrer URL);
your computer's operating system;
your computer's screen resolution;
IP address of the requesting computer;
language settings of the browser or operating system you use.

Further information can be found in Google's privacy information, available at: www.google.com/policies/privacy/.

The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time by changing the cookie settings on our website.

Rights of the data subject

You have the following rights:

Right of access

Under Article 15 GDPR, you have the right to request access to the personal data we process about you. This right includes information about:

the purposes of processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom your data has been or will be disclosed;
the envisaged retention period or, at least, the criteria used to determine that period;
the existence of a right to rectification, erasure, restriction of processing or objection;
the existence of a right to lodge a complaint with a supervisory authority;
the source of your personal data, where it was not collected from you;
the existence of automated decision-making, including profiling, and, where applicable, meaningful information about it.

Right to rectification

Under Article 16 GDPR, you have the right to have inaccurate personal data we hold about you rectified, or incomplete personal data completed, without undue delay.

Right to erasure

Under Article 17 GDPR, you have the right to request erasure of your personal data without undue delay, unless further processing is necessary for one of the following reasons:

the personal data is still necessary for the purposes for which it was collected or otherwise processed;
for exercising the right of freedom of expression and information;
for compliance with a legal obligation requiring processing under European Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health under Article 9(2)(h) and (i) and Article 9(3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes under Article 89(1) GDPR, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
for the establishment, exercise or defence of legal claims.

Right to restriction of processing

Under Article 18 GDPR, you may request restriction of the processing of your personal data for one of the following reasons:

You contest the accuracy of your personal data.
The processing is unlawful and you oppose the erasure of your personal data.
We no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims.
You object to processing under Article 21(1) GDPR.

Notification of recipients

If you have requested rectification or erasure of your personal data or restriction of processing under Article 16, 17 or 18 GDPR, we communicate this to every recipient to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You may ask us to identify those recipients.

Right to data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.

You also have the right to request that this data be transmitted to a third party, provided that the processing is carried out by automated means and is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR.

Withdrawal of consent

Under Article 7(3) GDPR, you have the right to withdraw your consent at any time by notifying us. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. We may no longer continue processing based on the consent you have withdrawn.

Right to lodge a complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR.

Right to object

If your personal data is processed on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right under Article 21 GDPR to object to processing on grounds relating to your particular situation, or where your objection concerns direct marketing. In the latter case, you have a general right to object which we will honour without requiring grounds relating to your particular situation. To exercise your right to withdraw consent or to object, simply email datenschutz@nakatanenga.de.

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

is necessary for entering into, or performing, a contract between you and us;
is authorised by European Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests;
is based on your explicit consent.

However, these decisions must not be based on special categories of personal data under Article 9(1) GDPR unless Article 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in points i) and iii), we implement suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

Changes to this Privacy Policy

If we amend this Privacy Policy, we will indicate this on the website and inform registered customers.

Last updated: 30 October 2026