Privacy notice

Here you can read which data are processed when you visit, submit a contact inquiry and have a conversation with N.I.K.A. Version: 13 October 2026.

1. Controller

The controller responsible for processing within the meaning of the General Data Protection Regulation (GDPR) is NetzTurm GmbH & Co. KG, Am Johannisberg 73, 53474 Bad Neuenahr-Ahrweiler, Germany. Contact person: Dirk Wershofen. Telephone: +49 2641 9115470. Email: mail@netzturm.com.

You can use these contact details to ask questions about privacy and exercise your rights.

2. Website, hosting and server logs

Our website and the sending of form emails are provided by profihost GmbH, Hildesheimer Straße 25, 30880 Laatzen, Germany. The hosting provider processes the data necessary for technical operation on our behalf.

When you access the website, your IP address and the requested content are transmitted as technically necessary. Server logs may also contain the date and time, the requested address, the HTTP status, the amount of data transmitted, the browser and operating system, and the page visited previously, insofar as your browser provides this information.

We use this data to make the website available, investigate errors and defend against attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is maintaining a secure and reliable website.

Technical logs are retained in accordance with the deletion and rotation rules configured for the server, for as long as necessary for operation, troubleshooting or investigation of specific security incidents. You can ask us about the retention period applicable to your visit.

The connection to the website is encrypted using HTTPS. Complete security for data transmissions over the internet cannot be guaranteed.

3. Contact form and email

If you contact us, we process your name, email address, message and any other data you provide voluntarily. The form requires a name, email address and message so that we can handle your inquiry. Providing this information is voluntary; without the required information, the form cannot be submitted. You can also contact us by email or telephone.

We use the data to handle your inquiry and communicate with you. The form sends your message by email and sends an automatic acknowledgment to the address provided. No additional database of inquiries is created on the website.

For inquiries concerning a contract or pre-contractual steps taken at your request, Article 6(1)(b) GDPR applies. We handle other inquiries on the basis of Article 6(1)(f) GDPR; our legitimate interest is responding to incoming questions.

The relevant employees at NetzTurm and technical service providers for hosting, email transmission and mailbox management have access to the data insofar as necessary for their work. Transmission between mail servers and processing by your own email provider also depend on that provider’s technical settings and privacy terms.

We delete inquiries and contact details once they have been handled and there is no further communication or other legal basis for retaining them. If a business relationship arises, we process the data necessary to carry it out. Statutory retention obligations and necessary retention for the establishment, exercise or defence of legal claims continue to apply. The data are deleted once the relevant periods have expired.

Your inquiry does not subscribe you to a newsletter. Do not submit health data or other particularly sensitive personal data through the form.

4. Protection against automated inquiries

The form uses a hidden check field and a server-side limit on the number of submissions. For this purpose, a hash derived from the IP address and timestamps are temporarily stored in a server file. The file contains no names, email addresses or message content. The hash is pseudonymised, not anonymised.

The limit uses a 15-minute time window. Older data are deleted when the next form inquiry is submitted. If there is no new inquiry, the file is not automatically cleaned up.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is preventing spam and misuse and keeping the form available. No external CAPTCHA service is used.

5. Language preference and local content

For language selection, the website may use the language specified by your browser. An explicit language choice is stored as ‘netzturm-lang’ in your browser’s local storage. This makes your preference available on a later visit. No user profile is created and the setting is not transmitted to an external service. The language path in the address, for example /en/, determines the content of that page.

The storage serves the language function you selected (§ 25(2), no. 2 of the German TDDDG). To the extent that personal data are processed, Article 6(1)(f) GDPR applies; our interest is retaining your language choice. The setting remains until you change it or delete the website data in your browser.

Statistics with Google Analytics 4: Only after you select Allow analytics do we load Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to assess page visits, language versions and openings of N.I.K.A. and improve our services. Google processes page addresses without URL query parameters, page titles, device and browser information, timestamps, a cookie identifier and technically necessary connection data including your IP address.

According to Google, GA4 does not store IP addresses. We do not send names, email addresses, telephone numbers, form content, search terms or conversation content to Analytics. Analytics is not loaded on the N.I.K.A. conversation page.

Google Signals, personalised advertising and advertising cookies are disabled in our integration. No Google Analytics tag is loaded before consent or after refusal. The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) of the German TDDDG. Consent is voluntary.

You may withdraw it for the future at any time using Privacy settings in the footer; prior processing remains lawful. On withdrawal, we disable measurement and remove accessible Analytics cookies. Our integration limits Analytics cookies to 90 days without automatic renewal. Your choice is saved for up to 180 days as netzturm-statistics-consent in your browser local storage so that we can respect it.

Event data are deleted according to the retention settings in our Analytics property; you can ask us about the current period using the contact details above. Google receives measurement data and processes them under its data processing terms. Processing by Google LLC and other providers outside the European Economic Area, particularly in the United States, is possible. The safeguards provided for this purpose are described in Google’s data processing terms, including applicable adequacy decisions and standard contractual clauses.

More information: policies.google.com/technologies/partner-sites and business.safety.google/adsprocessorterms/. Google Maps and external Google Fonts requests remain excluded. Fonts and images are loaded from our own web server.

6. N.I.K.A. – voluntary AI voice conversation

N.I.K.A. is our virtual AI assistant. Use is voluntary. You can also use the contact form, email or telephone. The voice connection starts only after you confirm the information about processing, click “Start conversation” and allow microphone access.

For the conversation, we process the name and email address you enter, your company if applicable, a telephone number you provide voluntarily, spoken content, the transcript, and generated answers and summaries. Technical connection data, including your IP address, are also processed. The purpose is to understand your question, provide information about our services and prepare a contact inquiry at your request.

We use API services from OpenAI for speech recognition, the voice connection and AI answers. For customers in the European Economic Area, OpenAI Ireland Ltd. is the contracting party. Voice data and necessary conversation context are transmitted to OpenAI in encrypted form and processed there. Processing by affiliated companies or service providers outside the EEA, particularly in the United States, is possible. OpenAI describes the safeguards intended for this purpose, including EU standard contractual clauses or applicable adequacy decisions, in its data processing addendum.

Processing for the voluntary AI conversation is based on your consent under Article 6(1)(a) GDPR. You can withdraw it for the future by ending the conversation or contacting us. This ends further processing for the conversation; previous processing remains lawful. Do not share health data, login credentials, trade secrets or other particularly sensitive information.

Conversation content is temporarily held in working memory on our server. The context is deleted after 30 minutes of inactivity and is also lost when the service restarts. We do not store audio files. Our application does not enable the storage of conversations by OpenAI. This does not mean that OpenAI does not retain data: according to its data controls, data may normally be retained for abuse monitoring for up to 30 days; longer retention required by law remains possible. According to this information, API content is not used by default to train models.

Your browser keeps the random access credential for the current N.I.K.A. session only in working memory. It links the conversation you started and is not used for advertising or analytics. To protect against misuse, the service processes pseudonymised IP hashes and request counters in time windows of up to 24 hours. These are regularly cleaned up while the service is running. The daily usage log contains only the date and reserved usage seconds, not conversation content or contact details.

A summary is created only at your request. You can review and edit the text before it is sent. A telephone number for a callback is voluntary; the conversation and inquiry are also possible without a telephone number. The number is included in the inquiry and email copy together with your confirmed contact details. We confirm your email address using a code that is valid for ten minutes. Only after you click “Send inquiry to NetzTurm” are the confirmed summary and contact details sent by email to NetzTurm and as a copy to the confirmed address. The full transcript is not sent automatically. The rules in section 3 then apply to handling and retention.

To prevent duplicate emails, the sending service temporarily stores a hashed inquiry ID, timestamps and sending status. This file contains no email addresses, names or message content. Data older than 24 hours are deleted when the next sending request is made. If there is no new request, the file is not automatically cleaned up.

N.I.K.A. may misunderstand information and give incorrect answers. Answers are not binding offers, contractual commitments or decisions about you. NetzTurm assesses specific projects personally.

7. Your rights

Subject to the statutory conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

You can withdraw consent at any time for the future. Previous processing remains lawful. We do not ask for consent to the privacy notice for the ordinary handling of a contact inquiry.

Right to object: where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims. You can always object to processing for direct marketing without giving reasons.

You can lodge a complaint with a supervisory authority (Article 77 GDPR), particularly in the country of your habitual residence, place of work or the alleged infringement. The competent authority for our registered office is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (www.datenschutz.rlp.de).

When contact inquiries are handled, no automated decision-making, including profiling, takes place within the meaning of Article 22 GDPR.