PRIVACY POLICY

Controller
General Information on Data Processing
Data Collected When You Visit This Website
Hosting
Cookies and Cookie Consent Tool
Web Analytics
Contacting Us
AI Potential Check
Online Appointment Booking
Data Processing Within the Business Relationship
Use of Processors and AI Services
Data Transfers to Third Countries
Retention Periods
Your Rights as a Data Subject
Automated Decision-Making
Right to Lodge a Complaint With a Supervisory Authority
Validity and Changes to This Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

nexantera AI - Robin Stute
Owner: Robin Stute

Schöne Aussicht 6
34414 Warburg
Germany

Phone: +49 5641 4054574
Email: rstute@nexantera.de

The controller is referred to below as "nexantera AI".

2. General Information on Data Processing

nexantera AI processes personal data exclusively on the basis of statutory requirements, in particular the GDPR and the German Federal Data Protection Act (BDSG). Personal data means any information relating to an identified or identifiable natural person.

This privacy policy informs you about the nature, scope and purpose of the processing of personal data in connection with this website and with our consulting and implementation services.

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" prefix and the padlock symbol in your browser bar.

3. Data Collected When You Visit Our Website

When you use the website for information purposes only, data is automatically recorded that your browser transmits to the server (known as server log files):

IP address (anonymised where applicable)
Date and time of access
Page accessed
Volume of data transferred
Referring website (referrer)
Browser and operating system used

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability, security and functionality of the website).

Retention period: This data is deleted automatically after a short period, unless specific evidence of unlawful use requires longer storage.

4. Hosting

This website is operated on servers provided by Wix.com Ltd., 6350671, Nemal Tel Aviv St. 40, Tel Aviv-Yafo, Israel. A data processing agreement pursuant to Art. 28 GDPR is in place with this provider.

When the website is accessed, technically necessary data (IP address, browser metadata) is transmitted to Wix servers.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing and maintaining the website).

An adequacy decision of the EU Commission is in place for Israel. Transfers to Wix's US sub-processors are based on EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

5. Cookies and Cookie Consent Tool

This website uses cookies. These are small text files stored on your device. A distinction is made between:

Technically necessary cookies: Set without consent (legal basis: Art. 6(1)(f) GDPR in conjunction with Section 25(2) no. 2 TDDDG).
Cookies requiring consent: Set only after you have actively given consent (legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG).

You can give, adjust and withdraw your consent at any time with effect for the future using the cookie consent tool. The tool itself stores your preferences via technically necessary cookies.

You can also configure your browser to notify you when cookies are set or to reject them altogether. If you reject cookies, website functionality may be limited.

6. Web Analytics

This website uses Wix Analytics for the statistical evaluation of website usage. The provider is Wix.com Ltd., 6350671, Nemal Tel Aviv St. 40, Tel Aviv-Yafo, Israel.

Pseudonymised data is processed, such as IP address, browser information, time spent on the site, clicks and scrolling behaviour. Pseudonymisation rules out any direct attribution to an individual.

Legal basis: Art. 6(1)(a) GDPR (consent given via the cookie consent tool).

You can withdraw your consent at any time via the cookie consent tool. An adequacy decision of the EU Commission is in place for data transfers to Israel.

7. Contacting Us

If you contact us by email, contact form or telephone, the data you provide (for example name, email address, phone number, content of your enquiry) is processed in order to handle your request.

Legal basis:

Art. 6(1)(b) GDPR for contract-related enquiries (pre-contractual measures)
Art. 6(1)(f) GDPR for all other enquiries (legitimate interest in responding)

Retention period: The data is deleted once your enquiry has been fully dealt with, provided no statutory retention obligations apply.

8. AI Potential Check

We offer the "AI Potential Check" on our website, an interactive self-assessment tool for evaluating your company's AI potential. If you complete the check, we process the information you provide in order to give you an individual result.

Data processed

Your answers to the questions in the check and the resulting evaluation (potential score, classification and recommended actions)
the industry you select
your contact details, insofar as you enter them: name, company, position and email address

Purposes and legal bases

Evaluating the check and sending you your result by email: This processing is carried out in order to deliver the service you requested. The legal basis is Art. 6(1)(b) GDPR.
Adding you to our contact list and contacting you personally: Only if you expressly give your consent in the form (by ticking the relevant box) will we add your contact details to a list in order to contact you personally about your result and our services. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future, for example by email to rstute@nexantera.de. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Recipients and processors: Your entries are transmitted and processed via our automation service n8n (n8n GmbH; see the section "Use of Processors and AI Services"). We send the result email via Google (Gmail). If you give your consent, we additionally store your contact details in a Google Sheets spreadsheet. The provider is Google Ireland Ltd. The website is hosted via Wix (see the section "Hosting"). Details on these processors, on third-country transfers and on the safeguards agreed can be found in the relevant sections of this policy and in our list of sub-processors.

Retention period: We store the data processed as part of the check only for as long as is necessary for the purposes stated. If you have not consented to being contacted, your contact details are not stored permanently. If you have given consent, we store your contact details until you withdraw that consent or until the purpose of contacting you no longer applies. Technical processing logs in n8n are deleted automatically after a short period.

9. Online Appointment Booking

We use the EU instance of Cal.com (Cal.eu) for scheduling free initial consultations and client meetings. The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA.

When you book an appointment, we collect your first and last name, email address, preferred appointment time and, where applicable, further information from the booking questions.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).

Retention period: After the appointment has taken place, the data is deleted unless a further business relationship is established.

A data processing agreement is in place with the provider. The booking instance is provided via Cal.eu (EU). As the provider is based in the USA, processing in the USA cannot be entirely ruled out. Such transfers are safeguarded by EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

10. Data Processing Within the Business Relationship

If you engage us for consulting, an automation service or an AI implementation, personal data is processed in two categories.
To perform the contractual relationship, we process master data of the contact persons involved (name, business contact details, function), contract data, communication data and payment information.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with tax and commercial law obligations).

Retention period: Until the end of the business relationship; thereafter the data is retained in accordance with statutory periods (in particular 6 or 10 years under the German Commercial Code, HGB, and the German Fiscal Code, AO).

11. Use of Processors and AI Services

The following sub-processors are used in the provision of our services:

Workflow automation: n8n GmbH (n8n Cloud), Berlin, Germany
AI language models and AI APIs: OpenAI, L.L.C. (San Francisco, USA) and Anthropic, PBC (San Francisco, USA)
Communication, file storage and calendar: Google Ireland Ltd. (Google Workspace)

A complete and current list of the sub-processors used, including details on purpose, data categories, server location and legal basis for third-country transfers, is available at https://www.nexantera.de/subprocessors

With OpenAI and Anthropic, the use of input data to train the models is excluded contractually and via the API configuration.

A project-specific list of sub-processors is provided as part of the data processing agreement. The contractual arrangements required under Art. 28 GDPR are in place with all sub-processors.

12. Data Transfers to Third Countries

Where data is transferred to recipients in third countries (outside the EU/EEA), this only takes place if an adequate level of data protection is ensured, in particular by:

Adequacy decisions of the EU Commission (for example the EU-US Data Privacy Framework)
Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR
Your explicit consent pursuant to Art. 49(1)(a) GDPR

13. Retention Periods

Retention periods are determined by the following criteria:

Where processing is based on consent: until consent is withdrawn
In contractual relationships: for the duration of the contract plus statutory retention periods (generally 6 to 10 years under HGB/AO)
Where processing is based on legitimate interests: until you object or the purpose ceases to apply
Server logs: short-term, for security and stability checks

14. Your Rights as a Data Subject

You have the following rights:

Access (Art. 15 GDPR) to the data stored about you
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Objection to processing (Art. 21 GDPR)

Note on the right to object (Art. 21 GDPR):

Where your data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. Where your data is processed for direct marketing purposes, you may object at any time without giving reasons.

An informal message to the contact details given in section 1 is sufficient to exercise your rights.

15. Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place on this website.

16. Right to Lodge a Complaint With a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR).

Competent supervisory authority:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestraße 2-4 40213 Düsseldorf, Germany Phone: +49 211 38424-0 Email: poststelle@ldi.nrw.de

17. Validity and Changes to This Privacy Policy

This privacy policy is currently valid and dated 1 July 2026. Changes in legal requirements or in our services may make amendments necessary. The current version is available on the website at https://www.nexantera.de/en/privacy

This English version is a translation provided for convenience. In the event of any discrepancy, the German version available at https://www.nexantera.de/datenschutz shall prevail.

Last updated: 1 July 2026