Privacy.

1. Controller and scope

Marc-André Gonser, trading as Nanuk IT R&D, is responsible for this website and the handling of enquiries. This notice covers the German, English and Russian website at nanukitrd.de and its protected previews on Netlify. Privacy requests may be sent to the email address below.

2. Website access and technical data

Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA, hosts and delivers this website. Accessing the website generates technical data including IP address, date and time, requested address, response status, and browser or device information. Referrer information is processed where the browser sends it.

This processing enables delivery, troubleshooting and protection against misuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, available and functional website. We do not combine this data into advertising profiles. Providing the necessary connection data is a prerequisite for accessing the site.

3. Hosting, processing arrangements and international transfers

Netlify acts as a processor. Its Data Processing Agreement, incorporated into its self-service contractual terms, is linked below. Infrastructure may involve processing outside the EU and EEA, particularly in the United States; we do not promise exclusive storage in Germany or the EU.

Netlify states that it participates in the EU-US Data Privacy Framework. Article 45 GDPR applies where a valid participation and the adequacy decision cover the particular transfer. For transfers not covered, appropriate safeguards under Article 46 GDPR, including standard contractual clauses and any necessary supplementary measures, must be assessed and implemented. The linked provider documents describe the transfer safeguards; copies or further information may be requested from the controller.

4. Email contact and Proton Mail

When you contact kontakt@nanukitrd.de, we process your sender address, message, communication metadata and voluntarily supplied details such as name and organisation to respond and handle the matter. Article 6(1)(b) GDPR applies to steps requested before entering into a contract with the person contacting us, or to performing that contract. Other enquiries, including communications with employees of a prospective business customer, rely on Article 6(1)(f) GDPR: our legitimate interest in appropriate business communication.

The mailbox is provided by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. The European Commission has adopted an adequacy decision for Switzerland. Proton identifies Switzerland, Germany or Norway as storage locations for Proton Mail. Ordinary email from external senders is not automatically end-to-end encrypted; Proton processes metadata and scans unencrypted incoming messages for spam and malware before encrypted storage.

5. Contact form and notifications

When you submit the contact form, Netlify Forms processes your email address, message, topic and language, plus optional name and organisation. Required fields are marked. Submissions are stored by Netlify. For verified submissions from all three language forms, Netlify sends an email notification containing the form data to kontakt@nanukitrd.de. Netlify uses Amazon Simple Email Service (Amazon Web Services) for delivery. This creates an additional copy in the Proton mailbox. Purposes and legal bases are as described in section 4.

There are no file uploads, newsletter subscriptions, orders or pre-orders. A form enquiry does not conclude a contract. Use is voluntary; without the information needed to respond, we may be unable to answer. Direct email remains an alternative.

6. Spam prevention: Akismet and a honeypot

According to its platform documentation, Netlify Forms uses Automattic’s Akismet service for server-side spam screening by default. When the form is used, processing for this purpose may include message content and submitted contact details as well as technical submission data such as IP address and browser identifier. An additional honeypot field does not replace this external processing step.

The legal basis is Article 6(1)(f) GDPR: protecting communication channels against automated abuse and preserving the ability to handle genuine enquiries. Screening may classify a message as spam; direct email remains available. Akismet forms part of the processing chain integrated through Netlify. The linked Netlify and Automattic documentation describes recipients, processing locations and transfer safeguards. Google reCAPTCHA is not embedded.

7. Retention and deletion

We retain enquiries for as long as needed to deal with them and maintain an appropriate record of communication. Afterwards, unnecessary details are deleted unless statutory retention obligations or a specific need to establish, exercise or defend legal claims require otherwise. Such records are kept for those purposes separately from ordinary contact enquiries. Article 6(1)(c) or (f) GDPR applies as appropriate.

No automatic deletion routine is active for Netlify form entries. Continued necessity is assessed individually and unnecessary entries are deleted manually. Spam entries require separate review. Copies in the Proton mailbox are handled separately. We do not promise fixed or system-wide automatic deletion after 30 days.

Provider-log retention is assessed against secure delivery, troubleshooting, abuse detection and any legal requirements. Retention depends on the provider and processing purpose; a short dashboard history does not establish a short overall retention period. Proton states that encrypted backups are kept for up to 30 days. Akismet describes periods from two weeks to 90 days for most spam-related data, with some data held longer. Those provider periods are not the retention period of the contact mailbox.

8. Cookies, analytics and external content

The supplied website code uses no marketing or analytics cookies, advertising tracking, externally loaded fonts, or embedded video, maps or social media widgets. Language selection uses separate URLs rather than cookies or local storage. Additional Netlify Analytics or Real User Monitoring features have not been configured for this site.

Any strictly necessary storage or access on your device is governed by section 25(2) of Germany’s TDDDG. Non-essential features would be subject to separate assessment and consent where required. Linking to an external service does not embed it; its own privacy information additionally applies when you open the link.

9. Recipients and purpose limitation

Data needed for each operation may be accessible to the hosting and forms provider, its relevant subprocessors including spam screening, and the email provider. Any further disclosure requires a legal basis, such as a statutory obligation to a competent authority. We do not sell enquiry data or use it for advertising, newsletters or AI model training without an appropriate basis.

10. Your data protection rights

Subject to the legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). Where processing relies on consent, you may withdraw it for the future without affecting the lawfulness of earlier processing. Requests may be sent to the controller’s contact address above.

We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you, nor perform profiling of that kind. Technical spam classification is a separate process.

11. Right to object under Article 21 GDPR

You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We will stop such processing unless compelling legitimate grounds or the establishment, exercise or defence of legal claims justify continuing it. An objection to direct marketing would be possible at any time without giving reasons.

12. Complaints and supervisory authority

You may complain to a data protection supervisory authority, particularly in the place of your habitual residence, work or the alleged infringement (Article 77 GDPR). The authority responsible for our location is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany; email: poststelle@lfdi.bwl.de. Its contact page is linked below.

13. Transmission security and changes

The website is delivered over HTTPS. This protects transport to the service, but is not end-to-end encryption against the forms provider. A separate transfer method will be agreed for confidential technical material. These notices and the underlying configuration will be updated when providers or processing purposes change.

Further provider information

• Netlify Data Processing Agreement
• Netlify Privacy Statement
• Netlify Subprocessors / Trust Center
• Netlify Forms: spam filters
• Netlify Forms: submissions
• Akismet Privacy
• Automattic: Privacy Notice for Visitors
• Proton Mail Privacy Policy
• European Commission: adequacy decisions
• Data Privacy Framework: official participant register
• LfDI Baden-Württemberg: Kontakt

Last reviewed: 5 September 2026