Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Nexus-Bridge GbR

Morgenstrasse 6

76137 Karlsruhe, Germany

Represented by: Louis Alwani

Phone: +49 721 89319042

Email: info@nexus-bridge.de

We have not appointed a data protection officer; we are not legally required to do so. For any data protection enquiries please use the contact details above.

2. Your rights

You have the right at any time to obtain information about the data we hold about you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object to processing based on a legitimate interest (Art. 21 GDPR).

Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with a data protection supervisory authority at any time (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Heilbronner Strasse 35, 70191 Stuttgart, Germany

Postfach 10 29 32, 70025 Stuttgart, Germany

Phone: +49 711 615541-0, email: poststelle@lfdi.bwl.de

3. Right to object

Where we process your personal data on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation (Art. 21 (1) GDPR).

On this website we rely on legitimate interests for the following processing operations:

• the storage of server log files (section 4) — legitimate interest: secure and stable operation of the website and the detection and prevention of attacks;
• limiting how often our forms can be submitted, based on the IP address (section 6) — legitimate interest: protection against automated bulk submissions and abusive use.

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

An email to info@nexus-bridge.de is sufficient to object; no particular form is required. Please tell us, as far as possible, the grounds arising from your particular situation — we need them for the balancing test the law requires, and we will inform you of the outcome of our assessment.

We do not process personal data for direct marketing purposes.

4. Hosting and server log files

Our website runs on a server located in Germany. The infrastructure is provided by IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany, with whom a data processing agreement pursuant to Art. 28 GDPR is in place.

Each time our website is accessed, access data is automatically stored in log files: the IP address of the requesting device, the date and time of access, the address requested, the HTTP status code, the volume of data transferred, the previously visited page (referrer) and the browser and operating system identifier (user agent). This processing is technically necessary in order to deliver the website and additionally serves to detect and defend against attacks and to analyse faults. The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

This data is not combined with other data sources and is not evaluated for audience measurement purposes.

5. Contacting us via our forms

Our website provides a contact form and a form for reporting staffing requirements. We process only the details you enter yourself:

• Contact form: name, email address, telephone number (optional), the nature of your enquiry (applicant or institution), company or institution, specialty, and your message in the free-text field.
• Form “Report staffing requirement”: position sought, field, preferred start date, name or institution, and email address.

In addition, the language version of the website you selected is transmitted so that we can reply in the same language.

We use this data solely to process your enquiry and to contact you about it. The legal basis is Art. 6 (1) (b) GDPR where your enquiry serves the initiation or performance of a contractual relationship, and otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in responding to enquiries. Consent is not required for this. The checkbox in the form is accordingly not a consent but serves solely to confirm that you have read this privacy policy; we record the time of that confirmation for documentation purposes.

Providing this data is voluntary and is neither required by statute nor by contract. Without your name and email address, however, we cannot process your enquiry or reply to you; no other disadvantages arise for you.

After submitting, you will automatically receive a confirmation of receipt at the email address you provided.

We delete your enquiry as soon as it has been dealt with conclusively and no statutory retention obligations apply. Enquiries that give rise to a contractual relationship are subject to commercial and tax retention periods of up to ten years (Section 147 AO, Section 257 HGB).

6. Protecting our forms against misuse

To prevent automated bulk submissions (spam), form submissions are checked by a procedure that runs entirely on our own server. No data is transmitted to third parties and no information is stored on your device.

We also limit the number of form submissions per sender. Your IP address is processed briefly for this purpose; it is not stored permanently, not combined with other data and not evaluated for any other purpose. The legal basis is our legitimate interest in preventing abusive use (Art. 6 (1) (f) GDPR).

7. Sending and receiving your message by email

Your form enquiry is delivered to us by email. Two service providers are involved:

Sending: messages are sent via the mail server of IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany. The transmission is transport-encrypted.

Receipt and mailbox: our email mailboxes are operated via Microsoft 365 (Exchange Online). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Your message is stored there for as long as it is required in order to deal with it. The basis is a data processing agreement in the form of the “Microsoft Products and Services Data Protection Addendum”.

Processing takes place within Microsoft’s EU Data Boundary. In narrowly limited cases — for example remote access by Microsoft technical personnel to resolve a fault — a transfer to the USA may occur. Such transfers are covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, to which Microsoft Corporation has adhered (Art. 45 GDPR); the European Commission’s standard contractual clauses apply in addition (Art. 46 (2) (c) GDPR).

8. Health-related information

Our contact form deliberately does not ask for health data. It contains no field for symptoms, diagnoses, findings, medication or medical history, and we do not need such information in order to answer your enquiry.

We therefore expressly ask you not to enter any details about symptoms, diagnoses, pre-existing conditions or medication in the message field.

If you nevertheless provide information from which conclusions about your health could be drawn, we process it only to the extent strictly necessary to answer your enquiry (Art. 5 (1) (c) GDPR). We do not enter it into structured records, do not evaluate it and do not use it for any other purpose.

In that case, processing is limited to answering your message and subsequently deleting it. The basis is the consent you give by deliberately entering it, pursuant to Art. 9 (2) (a) GDPR, which you may withdraw at any time with effect for the future — an email to info@nexus-bridge.de is sufficient. The lawfulness of processing carried out before the withdrawal remains unaffected.

All staff are bound to confidentiality. Access to incoming messages is restricted to those involved in handling your enquiry.

We delete health-related information we do not need without delay and do not transfer it into our records. If your enquiry gives rise to a contractual relationship, the retention periods applicable to that relationship apply.

9. Job applications

Applications reach us via the contact form (enquiry type “Applicant”) or by email. We process the data you submit exclusively in order to decide on the establishment of an employment relationship. The legal basis is Section 26 (1) in conjunction with Section 26 (8) BDSG and Art. 88 GDPR, and otherwise Art. 6 (1) (b) GDPR.

If no employment relationship comes about, we delete your documents six months after the procedure has been concluded; this period serves to defend against possible claims under the German General Equal Treatment Act. If you would like us to consider your application for future positions for longer, we will obtain your separate consent for this.

10. Content and images from our content management system

We maintain the content of this website in a content management system provided by Sanity. Texts and content are retrieved by our server and then delivered to your browser; no data about you is transmitted to the provider in the process. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

11. Storage of information on your device

Strictly necessary storage

The following is stored on your device out of technical necessity:

• Your decision in the consent banner, so that we do not have to ask you again on every visit. This is stored in your browser’s local storage.

No consent is required for this storage under Section 25 (2) no. 2 TDDDG, because it is strictly necessary in order to provide the service you have expressly requested. You can delete these entries at any time via your browser settings; the website remains fully usable.

Optional services and your consent

Our consent banner allows you to agree to optional services in the categories “Analytics” and “Marketing”. Such services are loaded only after you have given consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). We currently use no services in these categories: no audience measurement, no analysis of your behaviour on this website and no advertising evaluation takes place. Should we use such services in future, we will provide information here before they are activated.

You can change or withdraw your decision at any time via the “Cookie settings” link in the footer of every page. Withdrawal takes effect for the future; the lawfulness of processing carried out before then remains unaffected (Art. 7 (3) GDPR).

Language detection

On your first visit, our server evaluates the language setting transmitted by your browser (“Accept-Language”) in order to direct you to the appropriate language version. This information is not stored.

12. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

13. Recipients of your data

Apart from the service providers named in this policy — IONOS SE (hosting and email sending, Germany) and Microsoft Ireland Operations Limited (email mailboxes, Ireland) — we do not pass your data on to third parties. Beyond this, data is disclosed only where you have consented, where it is necessary for the performance of a contract with you, or where we are legally obliged to do so.

14. Changes to this privacy policy

We adapt this privacy policy when the procedures used on this website or the legal requirements change. The version published here applies in each case.