Legal

Privacy policy

Last updated: October 2026 · Version 1.0

Note: Template based on the EU General Data Protection Regulation (GDPR). Please insert the hosting provider (Section 4) and have the final text reviewed by a legal advisor before publication.

1. Controller

2. Data Protection Officer

We are not legally required to appoint a Data Protection Officer and have not done so. For all questions regarding data protection, please contact us at info@nexivanta-sys.com.

3. General principles

We process personal data only to the extent necessary to provide this website and to respond to enquiries. This website is deliberately designed to collect as little data as possible:

• No tracking or marketing cookies — this website does not set any such cookies. Only your consent choice itself is stored on your device (see Section 3a).
• No tracking or analytics — we do not use tools such as Google Analytics, Meta Pixel or similar services.
• No contact form, no newsletter, no user accounts — you can browse the entire site without providing any personal data.
• No third-party embeds — no external fonts, maps, videos or social-media plugins are loaded; all assets are hosted locally.

3a. Consent banner (technically necessary storage)

On your first visit, a consent banner is shown. Your choice ("Accept all", "Necessary only" or an individual selection) is stored on your own device in the browser's local storage (key: nxv_consent_v1) together with a timestamp, so that the banner does not reappear on every page and so that we can demonstrate that consent was given (Art. 7(1) GDPR). This entry contains no personal data beyond the choice and timestamp, is not transmitted to us or any third party, and is stored for 6 months, after which the banner is shown again. The legal basis is Art. 6(1)(c) GDPR (legal obligation to obtain and document consent) and § 25(2) of the German TDDDG / the corresponding Estonian provision on strictly necessary storage. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer.

4. Hosting and server log files

This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, United States.]. When you visit the site, the hosting provider automatically collects and stores technical data in server log files that your browser transmits:

• IP address (where technically possible, anonymised or shortened)
• Date and time of the request
• Page accessed and referrer URL
• Browser type and version, operating system

This data is processed to ensure the stability, security and technical operation of the website. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. Log data is not merged with other data sources and is deleted in accordance with the hosting provider's retention schedule. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

5. Contact by e-mail or phone

If you contact us by e-mail or phone, we process the personal data you provide (in particular your name, e-mail address, phone number and the content of your message) solely to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract) or, where no contract is involved, our legitimate interest in responding to enquiries pursuant to Art. 6(1)(f) GDPR. Your data is deleted once the enquiry has been fully resolved and no statutory retention obligations (e.g. under Estonian accounting or tax law) prevent deletion.

6. Recipients and third-country transfers

Your personal data is not sold or passed on to third parties for marketing purposes. Data is only disclosed where this is legally required or necessary to handle your enquiry. Processing takes place within the European Union / European Economic Area; no data is transferred to third countries.

7. Your rights as a data subject

Under the GDPR you have the following rights, which you can exercise at any time free of charge by contacting info@nexivanta-sys.com:

• Access (Art. 15 GDPR) — to obtain confirmation and information about your stored personal data;
• Rectification (Art. 16 GDPR) — to have inaccurate data corrected;
• Erasure (Art. 17 GDPR) — to have your data deleted, subject to statutory retention obligations;
• Restriction of processing (Art. 18 GDPR);
• Data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used, machine-readable format;
• Objection (Art. 21 GDPR) — to object at any time to processing based on Art. 6(1)(f) GDPR;
• Withdrawal of consent (Art. 7(3) GDPR) — with effect for the future, where processing is based on consent.

8. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for Estonia is:

9. Data security

This website is transmitted exclusively via encrypted HTTPS/TLS connections. We apply appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against accidental or unlawful manipulation, loss, destruction or unauthorised access.

10. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR on this website.

11. Changes to this policy

We may update this privacy policy from time to time, for example when the website is extended or legal requirements change. The version published on this page, with the date shown above, always applies.