Legal

Legal

Privacy Policy

1. General Information

The protection of your data is a particular concern to the operator of this website, nenna.ai GmbH. We process your data in accordance with applicable statutory provisions for the protection of personal data, in particular the EU General Data Protection Regulation (EU GDPR), national law (German Federal Data Protection Act / BDSG), and any applicable state-level implementing legislation. This privacy policy provides you with comprehensive information about the processing of your personal data by nenna.ai GmbH and the rights to which you are entitled.

Personal data means any information relating to an identified or identifiable natural person ('data subject'). This includes in particular name, date of birth, address, telephone number, email address, but also your IP address.

Data is considered anonymous where no connection to the identity of the user can be established.


1.1 Controller and Data Protection Officer

nenna.ai GmbH
Kadiner Str. 11
10243 Berlin

Phone: +49 (0) 1579-2372018
Email: hello[at]nenna.ai

Data Protection Officer: Michael Vogelbacher, Attorney at Law, Advokat Pro
Contact: vogelbacher[at]advokatpro.de


1.2 Your Rights as a Data Subject

We would like to inform you of your rights as a data subject. These rights are set out in Articles 15 to 22 of the GDPR. These include:

  • The right to access (Art. 15 GDPR)

  • The right to erasure (Art. 17 GDPR)

  • The right to rectification (Art. 16 GDPR)

  • The right to data portability (Art. 20 GDPR)

  • The right to restriction of processing (Art. 18 GDPR)

  • The right to object to processing (Art. 21 GDPR)

To exercise these rights, please contact: privacy[at]nenna.ai. The same applies if you have questions about data processing within our company. You also have the right to lodge a complaint with a supervisory authority for data protection.


1.3 Right to Object

Please note the following with regard to the right to object pursuant to Art. 21 GDPR:

Where we process your personal data for the purposes of direct marketing, you have the right to object at any time to such processing. This also applies to profiling insofar as it is related to direct marketing.

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes. The objection is free of charge and may be submitted without formal requirements, preferably to: privacy[at]nenna.ai.

Where we process your data on the basis of legitimate interests, you have the right to object, on grounds relating to your particular situation, at any time to such processing; this also applies to profiling based on those provisions. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.


1.4 Purposes and Legal Bases for Data Processing

In processing your personal data, we comply with the provisions of the GDPR and all other applicable data protection legislation. The legal bases for processing are set out in particular in Art. 6 GDPR.

We use your data:

  • for the initiation of business relationships,

  • for the performance of contractual and legal obligations,

  • for the performance of the contractual relationship,

  • on the basis of legal provisions, and

  • on the basis of a legitimate interest, such as the provision of products and services and the strengthening of customer relationships, which may include analyses for marketing purposes and direct marketing.

Your consent also constitutes a legal basis for processing, which must be given freely following prior disclosure of the purpose of the processing, in accordance with Art. 7(1) GDPR. Should you not provide consent, you must expect to have only limited access to certain data. You have the right to withdraw any consent given at any time with effect for the future pursuant to Art. 7(3) GDPR. Withdrawal is free of charge and may be submitted informally, preferably to: privacy[at]nenna.ai.

If consent also relates to the processing of special categories of personal data pursuant to Art. 9 (1) GDPR, we will expressly draw your attention to this in the consent declaration. Where the processing of special categories of personal data occurs on the basis of an employment relationship, such data will be collected and processed pursuant to the legal obligation under Art. 9(2)(b) GDPR and § 26 BDSG.


1.5 Disclosure to Third Parties

Your data will only be disclosed to third parties in accordance with statutory provisions or with your corresponding consent. Otherwise, your data will not be disclosed to third parties, unless we are obliged to do so under mandatory legal provisions (e.g., disclosure of data to external bodies such as supervisory authorities or law enforcement authorities).


1.6 Data Recipients / Categories of Recipients

Within our organisation, we ensure that only those persons receive your data who require it for the fulfillment of contractual and legal obligations.

In many cases, service providers support our departments in fulfilling their tasks. The required data protection agreements have been concluded with all service providers. We use, for example, services such as the provision of technical infrastructure by software and communications service providers.


1.7 Transfer to Third Countries / Intention to Transfer Personal Data to Third Countries

Transfer of personal data to third countries (outside the European Union or the European Economic Area) shall only take place:

  • where this is necessary for the performance of the contractual relationship,

  • where required by law, or

  • where you have granted us your consent.

Compliance with the required level of data protection is ensured.


1.8 Data retention period

We store your data exclusively for the purpose of data processing for which it was collected, in accordance with the legal basis pursuant to Art. 6 (1) GDPR. Once the purpose has been fulfilled or no longer applies, i.e., where there is no longer any necessity for processing or storage, the data will be completely erased or anonymised. Please note that numerous retention obligations may require continued storage of data. This applies in particular to retention obligations under commercial law, tax law, employment law (e.g., German Commercial Code, Tax Code, General Equal Treatment Act, etc.). Where no further retention obligations exist, data will be routinely erased once the purpose has been achieved.

Furthermore, we may retain data where you have given us your permission to do so, or where legal disputes arise and we require evidence within the framework of statutory limitation periods, which can be up to thirty years; the regular limitation period is three years.


1.9 Secure Transmission of Your Data

To best protect the data stored by us against accidental or unlwaful destruction, loss, unauthorised disclosure of, or access, we implement appropriate technical and organizational security measures. Security levels are continuously reviewed in cooperation with security experts and adapted to new security standards.

Data exchange to and from our website is encrypted at all times. We offer HTTPS as the transmission protocol for our website, using current encryption protocols. Additionally, there is the option to use alternative communication channels (e.g., by mail).


1.10 Obligation to Provide Data

Various personal data are required for the establishment, performance and termination of the contractual relationship and the fulfilment of associated contractual and legal obligations. The same applies to the use of our website and the various functions it provides.

Details have been summarised in the point above. In certain cases, data must also be collected or provided on the basis of legal requirements. Please note that processing your request or performance of the underlying contractual relationship is not possible without provision of this data.


2. Categories, Sources and Origin of Data

Which personal data we process is determined by the respective context: it depends on, for example, whether you place an order online, enter an enquiry in our contact form, send us an application, or submit a complaint.

Please note that we may provide separate information in appropriate places for specific processing situations, for example when you upload application documents or submit a contact inquiry.

When you visit our website, we collect and process the following data:

  • Name of internet service provider

  • Information about the website from which you visit us

  • Web browser used and operating system

  • IP address assigned by your internet service provider

  • Files requested, volume of data transferred, downloads/file exports

  • Information about the web pages accessed, including date and time

For technical security reasons (in particular to ward off attacks on our web server), these data is stored in accordance with Art. 6 (1) lit. f GDPR. No later than 7 days after collection, anonymisation is carried out by shortening the IP address, so that no reference to the data subject is possible.


2.1 Newsletter (Art. 6 (1) lit. a GDPR)

On our website, you can subscribe to a free newsletter. The email address provided when subscribing to the newsletter is used to send the newsletter.

The principles of necessity and data minimisation are observed, as only the email address (or name in the case of personalised newsletters) is marked as a mandatory field. For technical reasons and for legal protection purposes, your IP address is also processed when subscribing to the newsletter.

We use the so-called double opt-in procedure for sending newsletters by email. This means that you will only receive advertising by email if you have previously expressly confirmed that we should activate the newsletter service for you. This is done by sending you a notification email and asking you to confirm by clicking on a link contained in that email that you wish to receive our newsletter at that email address.

You may of course withdraw your consent at any time by using the unsubscribe option provided in the newsletter, thereby revoking your consent.

We also use a newsletter tracking pixel. This is a technology embedded in emails as small, invisible graphics to track when an email has been opened and from which device. These pixels enable senders to analyze data about email usage, such as how users read our newsletter, which information is clicked on most frequently and which is not. The aim is to optimise our newsletter to make it more appealing, easier to read and more informative for you. The collected data is stored anonymously and is not attributed to any data subject. The data collected are purely statistical in nature, as it they are collected exclusively as anonymous information and are not linked to your other personal data.


2.2 HubSpot

(Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG)

Our website uses HubSpot software. HubSpot is a software company from the USA with an office in Ireland. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500. At the contracting entity in Ireland (Dublin), as a member state of the European Union, protection is fully ensured through the application of the GDPR. Should data processing unexpectedly take place in the USA as a third country, the Data Privacy Framework (DPF) applies, which provides transfer guarantees.

The software helps us, among other things, to improve our marketing through statistical analyses and evaluations of recorded user behavior. Cookies are used for this purpose. You can prevent the storage of cookies at any time through the appropriate settings in your browser software or delete already stored cookies.

Please note that you may not be able to fully use all services provided on our website if you block cookies. Further information can be found in the terms of service and privacy policy of HubSpot Inc. at http://www.hubspot.com/terms-of-service and http://www.hubspot.com/privacy-policy.

Our registration service enables visitors to our website to learn more about our organisation, download content, and provide their contact information and other demographic information. This information, as well as the content of our website, is stored on the servers of our software partner HubSpot. They may be used by us to contact visitors to our website and to determine which services/topics of our company are of interest to you. All information we collect is subject to this Privacy Policy. We use all collected information exclusively to optimise our marketing.

For scheduling consultation appointments, personal data for contact purposes are collected and processed. This includes first name, last name, email address, and where applicable, company name for sole traders or freelancers. The provision of this data is required for the consultation. The legal basis for this is the performance of pre-contractual measures or the fulfillment of a contract. No disclosure of this data to third parties takes place.

You can view HubSpot's privacy policy here: https://legal.hubspot.com/data-privacy


2.3 Pipedrive (Art. 6 (1) lit. a GDPR)

Personal data that you have provided to us through a contact request, a content download, or direct business relationship is processed and maintained in accordance with Art. 6 (1) lit. a GDPR using a customer relationship management system (CRM system).

The operator and provider is Pipedrive OÜ:

Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Harju maakond, Estonia.

The CRM system is cloud-based. Further information can be found on the Pipedrive website: https://www.pipedrive.com/en/privacy. During the registration process, you also have the option of giving us your consent for marketing communications. It is of course also possible to complete registration without providing marketing consent. If you give us your consent by ticking the relevant checkbox, we will also process your personal data to send you information and offers relating to our products/services. You may withdraw your consent at any time with effect for the future.


3. Cookies (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG with consent)

Our website uses so-called cookies in various places. They are used to make our service more user-friendly, efficient and secure. Cookies are small text files that are stored on your device.

These cookies enable us to analyse the use of our website by users. This allows us to design the content of the website according to the needs of visitors. Furthermore, cookies enable us to measure the effectiveness of a particular advertisement and to place it, for example, according on the thematic interests of the user. The legal basis for this is Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG; cookies are only set after your consent, with at least technically necessary cookies beeing applied. Most of the cookies we use are so-called "session cookies". These are automatically deleted after your visit. Persistent cookies are automatically deleted from your device once their validity period (usually six months) expires or you delete them yourself before their validity period expires.

You may give your consent through our cookie consent tool and withdraw it at any time (link at the bottom of the footer).

We use the following cookies:

First-party cookies (own cookies): This type of cookie is controlled directly by nenna.ai GmbH. Depending on the purpose, they remain stored permanently – even after the end of the session (so-called persistent cookies, e.g. for implementing opt-out) or are deleted when the browser is closed (so-called session cookies; valid for one browser session only).

Third-Party Cookies: This type of cookie is controlled by third party providers. Third-party providers are providers who display advertising banners on other websites on behalf of nenna.ai GmbH. They use cookies to transmit, for example, the information that an advertising banner displayed to you resulted in a purchase (e.g. conversion tracking).

So-called temporary/permanent cookies are used for this purpose; they are automatically deleted after the specified period (usually 6 months). These temporary or permanent cookies are stored on your device and delete themselves after the specified period. The cookies of our partner companies also contain only pseudonymized, mostly even anonymous data. They enable our partners to understand which products you have viewed, whether anything was purchased, which products were searched for, etc. In this context, some of our advertising partners also collect information beyond these websites about which pages you previously visited or which products you were interested in. This enables the display of personalised advertising. This pseudonymous data is never merged with your personal data.

The purpose of including such third-party cookies is to provide you with comprehensively researched information on our website free of charge. Marketing advertising space to the third parties described below enables us to provide you with these offers largely free of charge and thus make a significant contribution to the dissemination of knowledge, information gathering and exchange of views.

Most web browsers automatically accept cookies. Of course, you can also manually disable, restrict or delete cookies through the settings of your browser or remove them using software. Please note: If you disable the use of cookies, you may not be able to use all functions of our website to their full extent.


4. Web Tracking


4.1 Google Analytics

This website uses Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), on the basis of your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG). Processing by the processor (server) takes place in Ireland (Dublin), which, as a member state of the European Union, ensures full protection through the application of the GDPR. Should data processing unexpectedly take place in the USA, which is a third country, the Data Privacy Framework (DPF) applies, which provides transfer guarantees.

Google Analytics uses cookies that are stored on your device and enable analysis of your use of the website. The information generated by the cookie about your use of this website, such as:

  • Browser type/version,

  • Operating system used,

  • referrer URL (previously visited page),

  • Hostname of the accessing device (IP address) and

  • Time of server request

is typically transmitted to a Google server in the USA and stored there. The IP address transmitted by your browser as part of Google Analytics is not merged with other data from Google. We have also implemented Google Analytics on this website with the "anonymizeIP" code. This ensures anonymisation of your IP address, so all data is collected as anonymous information. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.

Google may also transmit this information to third parties where required by law or where third parties process such data on Google’s behalf. In no case will Google link your IP address with other Google data. You can prevent the storage of cookies through appropriate browser settings; however, we point out that you may not be able to use all functions of this website in full.

By using this website, you consent to the processing of personal data concerning you by Google in the manner and for the purpose described above. Further information can be found at www.google.com/privacypolicy.html.

The website also uses the technical extension "Google Signals", which enables cross-device tracking. This allows a single website visitor to be assigned to multiple devices. However, this only occurs if the visitor is logged into a Google service and has simultaneously activated the "personalised advertising" option in their Google account settings. Even then, no personal data or user profiles are accessible; you remain anonymous to nenna.ai.

If you do not wish to use "Google Signals", you can disable the "personalised advertising" option in your Google account settings at any time.

You can also prevent the storage of cookies through appropriate settings in your browser software. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

You may withdraw your consent at any time with effect for the future by accessing our consent banner and disabling the corresponding consent. Please note that changes to the settings in the consent banner must be made individually for each device. You may also make changes in our content banner in the footer below.


4.2 Google Tag Manager

We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by the processor (server) by Google Tag Manager takes place in Ireland (Dublin), which, as a member state of the European Union, ensures full protection through the application of the GDPR. Should data processing unexpectedly take place in the USA as a third country, the Data Privacy Framework (DPF) applies, which provides transfer guarantees.

Google Tag Manager manages and controls tags deployed on our website, for example to create a cookie banner that allows you to individually decide on the use of cookies and tracking technologies.

In order to monitor the stability, performance and installation quality of the system and obtain diagnostic data, Google Tag Manager collects certain aggregated data on tag firing. This data contains no IP addresses or measurement IDs linked to a specific individual. Unlike data in standard HTTP request logs, which are deleted within 14 days of receipt, and the diagnostic data described above, Google Tag Manager does not collect, store or share information about visitors to our customers' properties. This also applies to the URLs of pages visited.

Google Tag Manager itself does not process personal data. It merely triggers other tags, which may, under certain circumstances, collect data. However, such data is only collected where you have given your consent via our cookie banner (in accordance with Art. 6 (1) lit. a GDPR).

The cookie banner is designed so that only technically necessary cookies are set without your consent. All other cookies or tracking technologies are activated only after your active consent. You may withdraw or adjust your consent at any time through the cookie banner settings.

Google Tag Manager (GTM) uses a Consent Mode, which is a framework that controls how Google tags respond based on the consent status of users. It ensures that tracking scripts such as Google Analytics, Google Ads and other marketing tags respect users‘ consent. If cookies are rejected, tags can still be executed without storing personal data, enabling basic measurements such as page views or conversions while complying while simultaneously ensuring GDPR compliance.

Further information on how Google Tag Manager works can be found in Google's privacy policies.


4.3 Google Ads Conversion Tracking and Conversion Linker

We use Google Ads Conversion Tracking and Google Conversion Linker from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google") to measure the effectiveness of our advertising campaigns and display advertising relevant to you.

When you access our website via a Google advertisement, Google sets cookies and uses local storage. The cookie _gcl_au stores the ad click ID for correct attribution of conversions and is stored by Google for approximately 90 days. Local storage is used to temporarily cache click data for conversion attribution for the duration of a session or approximately 90 days.

The following personal data are processed in this context: your IP address, the click ID (GCLID), device and browser information, and information about your interaction with our website following the ad click (e.g., pages visited, purchases, registrations).

Google shortens IP addresses by default before storage. Your full IP address is not stored permanently.

Transfer to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA may take place. Google LLC is certified under the EU-US Data Privacy Framework (DPF). Additionally, Standard Contractual Clauses (SCCs) have been concluded with Google to ensure contractual protection of your data.

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

Data processing is carried out on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG.

You may withdraw your consent at any time with effect for the future through our cookie settings (cookie banner / preference center) and through Google's ad settings.

With Google Consent Mode activated, the cookie- writing behaviour is restricted until consent has been granted.

Further information on how this functions can be found in Google's privacy policies.


4.4 Leadfeeder

Our website uses technologies from Leadfeeder (Leadfeeder Finland Oy as part of Leadfeeder Group GmbH) ("Leadfeeder") in order to analyse visitor behavior and understand which companies (B2B) are visiting our website.

Leadfeeder processes your IP address and corresponding session data. The IP address is enriched with associated information such as company name or industry codes. For this purpose, at the start of the session, the IP address of the website visitor and the corresponding session data are compared against an extensive whitelist of known companies.

As part of this processing, so-called first-party cookies from Leadfeeder are used to analyse visitor behavior.

Processing of your personal data is carried out on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. To prevent this processing, website visitors may install and configure appropriate ad blockers or use no-script plugins in their browser. Personal data will be erased as soon as it is no longer required for its intended purposes. However, legal retention obligations may result in longer retention periods for the relevant data. We have concluded a data processing agreement with Leadfeeder to ensure compliance with applicable data protection standards.

Further information about Leadfeeder can be found in Leadfeeder's privacy policies.


5. Hosting

For our website, we use Framer Hosting as a hosting service from AWS European Sovereign Cloud (Amazon Web Services, Inc.), Eschborner Landstraße 100, 60489 Frankfurt am Main, Germany. This is an independent cloud infrastructure that is entirely located within the EU and whose operation will be physically and logically independent of the global AWS instance www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/260115_BSI_AWS_European_Cloud.html.

Should data processing unexpectedly take place in the USA as a third country outside the European Union (EU), the Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC) apply, which provide transfer guarantees.

Framer hosting is optimised with edge caching, pre-rendering and dynamic image optimisation (WebP/AVIF), ensuring fast page load times worldwide. It offers secure SSL certificates, data is encrypted during transmission and at rest, and the infrastructure includes DDoS protection and password protection. The following personal data of website visitors and customers are collected, stored and processed

  • Referrer (previously visited website)

  • Requested website or file

  • Browser type and browser version

  • Operating system used

  • Device type used

  • Time of access

  • IP address in anonymised form (used only to determine the location of access)

Once the purpose of data processing is fulfilled, erasure takes place.


6. Social Media

On our website you will find a link to our social media presence on LinkedIn. Links to social network websites can be identified by the respective company logo. If you follow this link, you will be taken to our company profile on the relevant social media platform. When you click on a link to a social network, a connection to the servers of the respective social network is established. In this process, it is transmitted to the servers of the social network that you have visited our website.. Furthermore, additional data is transmitted to the social network provider. This includes, for example:

  • The address of the website on which the activated link is located,

  • Date and time of the website visit or activation of the link,

  • Information about the browser used and the operating system,

  • IP address.

Responsible for company profiles within the meaning of the EU General Data Protection Regulation (GDPR) and other data protection provisions are, in addition to us, also:

  • LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)

If you are already logged in to the respective social network at the time of link activation, the social network provider may be able to identify your username and possibly your real name based on the transmitted data and link this information with your personal user account on the social network. You can prevent this by logging out of your user account before clicking on the link.

The servers of social networks are located in the USA and other countries outside the European Union. Personal data may thereore also be processed in countries outside the European Union by the provider of the social network. Please note that companies in these countries are subject to data protection laws that may not protect personal data to the same extent as in the member states of the European Union.

Please note that we have no control over the extent, nature and purpose of data processing by the social network provider. Further information about the use of your data by social networks integrated into our website and information about objection options can be found in the links below:

LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy Opt-out: https://www.linkedin.com/legal/cookie-policy

We use social media pixels, which are invisible graphics embedded in web pages, online advertising or emails to measure page views, clicks and email opens. These tracking tools are generally transparent and enable companies to collect user data to enable precise measurement and optimisation of advertising campaigns.

Overall, you have the following rights with respect to the processing of your personal data:

  • Right of access,

  • Right to rectification,

  • Right to erasure,

  • Right to restrict of processing,

  • Right to object,

  • Right to data portability,

  • Right to lodge a complaint about unlawful processing of your personal data with the competent data protection authority.

Since we do not have complete access to your personal data, you should contact the social network providers directly if you wish to exercise these rights, as they have respective access to the personal data of their users and can take appropriate action and provide information.


7. Links to Other Providers

Our website also contains – clearly visible – links to websites of other companies. Where links to websites of other providers exist, we have no control over their contents and therefore cannot accept responsibility or liability for such content. Responsibility for the content of linked pages lies at all times with the respective provider or operator of those pages.

The linked pages were reviewed at the time of linking for possible legal violations and recognizable infringements of law. Illegal content was not apparent at the time of linking. However, permanent content monitoring of linked pages is not reasonable without concrete evidence of a legal violation. If we become aware of legal violations, such links will be removed immediately.


8. Nenna Enterprise AI Enablement Platform

Use of the Nenna Enterprise Enablement Platform requires a customer account for which a separate data processing agreement will be concluded. The processing of personal data within the framework of the software is carried out in accordance with the provisions of the data processing agreement and the specific data protection requirements of the customer.