Privacy Policy
§ 1 Data Controller
Data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation:
nxvnt GmbH
Gronowskistr. 69, 48161 Münster, Germany
Email: info [at] nxvnt [dot] com
Managing Director: Torben S. Meier-Ulrichsen
Commercial Register: District Court Münster – HRB 23253
§ 2 Overview
nxvnt.com is the corporate website of nxvnt GmbH and serves to present the company and its products BigHoot AI and Ukeou. This privacy policy explains what personal data we collect, process, and for what purpose.
§ 3 Data Collected and Legal Basis
3.1 Contact Form (Art. 6(1)(b) GDPR)
- Name
- Email address
- Message content
Purpose: Processing your inquiry and contacting you. The form does not store data on our server; it opens your email client with the details you entered, and the message is sent via your own email provider.
3.2 Server Logs (Art. 6(1)(f) GDPR)
Our hosting provider collects technical access data (IP address, timestamp, requested resource, user agent, referrer). IP addresses are anonymized or deleted in accordance with statutory retention periods.
3.3 Usage Analytics with BigHoot AI (Art. 6(1)(f) GDPR)
We use our own product BigHoot AI to analyse website usage. We process pseudonymous visitor and session IDs, pages viewed, time on page, click, scroll and mouse movements, referrer, truncated IP address, device type, browser and screen resolution. This produces heatmaps; input in form fields is masked. Recording of individual sessions (session replay) is disabled for this website.
Measurement is cookieless and does not store identifiers on your device: BigHoot AI sets neither cookies nor local or session storage entries. There is therefore no access to information on your terminal equipment within the meaning of Sec. 25 TDDDG, so no consent is required. Session attribution lasts only for the duration of your visit. Purpose: improving the content, structure and usability of this website. You may object at any time (contact see § 9).
The provider is nxvnt GmbH itself; data is processed on our own infrastructure and never shared with third parties for advertising purposes.
3.4 Web Fonts (Art. 6(1)(f) GDPR)
This website loads fonts from Google Fonts (Google Ireland Limited, Ireland). Your IP address is transmitted to Google in order to deliver the font files. A transfer to the USA cannot be excluded; Google LLC is certified under the EU-US Data Privacy Framework.
§ 4 Sub-Processors and Third-Party Services
We use the following service providers:
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Lovable / Supabase Inc. | Hosting, CDN, analytics endpoints | EU / global | EU-US DPF, DPA |
| Cloudflare Inc. | CDN, DNS, DDoS protection, SSL/TLS | EU PoPs / global | EU-US DPF, DPA |
| Google Ireland Ltd. | Google Fonts | EU / USA | EU-US DPF |
§ 5 International Data Transfers
Where personal data is transferred to third countries (outside the EEA), this is done on the basis of:
- Adequacy decision: EU-US Data Privacy Framework (DPF) for US providers certified under the DPF.
- Standard Contractual Clauses (SCCs): Supplementary to DPF certifications where available.
§ 6 Cookies and Tracking
This website uses no consent-requiring cookies and no third-party analytics or advertising services.
- Usage analytics: BigHoot AI is cookieless and stores no identifiers in local or session storage (see § 3.3). Consent under Sec. 25 TDDDG is therefore not required.
- Strictly necessary cookies: Our hosting/CDN provider sets cookies for delivery and bot protection (e.g.
__cf_bm,__dpl). They are necessary for operation (Sec. 25(2) no. 2 TDDDG) and are not used for analytics. - Language preference: Language is determined via the URL (/de or /en). No data is stored in the browser for this.
You can delete or block stored site data at any time via your browser; the website remains fully usable.
§ 7 Data Retention
- Contact inquiries: Until your matter is fully resolved, maximum 6 months.
- Server logs: Maximum 30 days.
- Analytics data (BigHoot AI): Maximum 12 months.
§ 8 Data Security
We implement appropriate technical and organizational measures:
- TLS/HTTPS encryption for all data transmissions
- Encryption at rest
- GDPR-compliant logging without personal data
§ 9 Your Rights
Under the GDPR, you have the following rights:
- Access (Art. 15): You can request information about your stored data.
- Rectification (Art. 16): You can request the correction of inaccurate data.
- Erasure (Art. 17): You can request the deletion of your data.
- Restriction (Art. 18): You can request the restriction of processing.
- Data portability (Art. 20): You can request your data in a common format.
- Objection (Art. 21): You can object to processing based on legitimate interests.
- Complaint: You have the right to lodge a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
Contact for data protection inquiries: info [at] nxvnt [dot] com
§ 10 Changes to This Privacy Policy
We reserve the right to update this privacy policy to reflect changes in legal requirements or modifications to the website. The current version is always available on this page.
Last updated: 03.09.2026