Privacy Policy

Version: 10 August 2026 · Edition 4

This is the English edition of our privacy policy. It is intended to be complete and correct on its own. References to legal provisions are given in their German citation form, followed by the English name of the act, because they refer to German and European law: DSGVO is the General Data Protection Regulation (GDPR), TDDDG the German Telecommunications Digital Services Data Protection Act, BDSG the German Federal Data Protection Act, and DDG the German Digital Services Act.

1. Controller

New Media Service GmbH

Hegau-Tower, Maggistraße 5, 12th floor, 78224 Singen (Hohentwiel), Germany

Phone: +49 7731 96939-0 · Email: info@nms.de

2. Data protection officer

Our data protection officer is Gerhard Söbbing. You can reach him directly and confidentially at datenschutz@nms.de, or by post at the address above marked “Vertraulich – Datenschutzbeauftragter”. Messages sent this way are not seen by other parts of the company.

3. Principles

Personal data is processed only where this is necessary to provide this website, to answer enquiries, or to comply with legal obligations. Without your consent, no audience measurement and no advertising-related tracking takes place; the corresponding cookies are not set and no data is transmitted to the providers concerned. What else you can enable, and what it does, is described below under “Consent management, audience measurement and marketing”.

4. Hosting and server log data

This website is operated by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through a global content delivery network. The application database is provided by Neon, LLC, a company of Databricks, Inc. (USA), and stored in the AWS data centre in Frankfurt (region eu-central-1). When the website is accessed, the host processes technically necessary server log data (IP address, date and time, page requested, user agent) in order to deliver the website and to ensure the security of its operation. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest lies in secure and reliable operation. Both providers process this data as processors under Art. 28 DSGVO on our behalf.

Transfers to the USA are based, for both providers, on the EU standard contractual clauses under Implementing Decision (EU) 2021/914 in conjunction with the providers’ published data processing agreements. No adequacy decision under Art. 45 DSGVO is relied upon for these transfers. A copy of these safeguards is available on request via the contact details given under section 1; this also applies to all providers named below. Server log data is deleted after 30 days at the latest.

5. Error and stability monitoring (Sentry)

So that faults on this website can be detected and fixed, we use Sentry, a service of Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Data is sent to an endpoint in Germany; the recipient, and therefore the relevant legal entity, is nevertheless the US company, because access from there cannot be ruled out. Transfers are based on the EU standard contractual clauses under Implementing Decision (EU) 2021/914.

We distinguish two cases. On the server, monitoring runs independently of your consent: it processes technical error data, in particular the error message, its location in the program code and the time it occurred, together with a sampled share of performance data. Request contents, cookies, headers and query strings are removed before transmission, and the option to transmit personal details is switched off. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest lies in detecting faults that would otherwise affect visitors without us hearing about them. In the browser, monitoring runs only after your consent to the category “Statistik”; without consent it is not started and no connection is established.

Error data is deleted after 90 days.

6. Cookies and local storage

Without your consent, this website uses only technically necessary storage: the session management of the system and the local storage of your cookie decision (localStorage, entry “nms-consent”). The legal basis is § 25 Abs. 2 TDDDG in conjunction with Art. 6 Abs. 1 lit. f DSGVO. Optionally, and only with your consent, three categories are added: “Statistik” (audience and error measurement), “Marketing” (remarketing) and “Externe Medien” (videos, location map, appointment calendar). The legal basis for these is Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG. The category names appear in German because that is how they are labelled in the consent dialogue.

The entry named above stores your selection of the three categories, the time of the decision and the version of the consent text, so that we can demonstrate and respect your decision. The entry has no fixed expiry date; it remains until you change your decision or clear your browser storage. However, if the categories or purposes change, an earlier consent no longer applies and you will be asked again. Using the “Cookie-Einstellungen” link in the footer, you can withdraw your consent at any time, as easily as you gave it; withdrawal takes effect for the future.

7. Contact form and email contact

When you use the contact form, the data you provide (name, company, email address, optionally phone number, message) is processed in order to handle your enquiry and stored in our content management system. Email is sent via Mailgun Technologies, a service of the Sinch group; our account is configured so that delivery runs through servers in the EU region. The provider processes this data as a processor on our behalf. For transfers to third countries, the provider’s published agreements provide for the EU standard contractual clauses under Implementing Decision (EU) 2021/914.

For enquiries directed at a contract, the legal basis is Art. 6 Abs. 1 lit. b DSGVO (pre-contractual measures); for other enquiries it is Art. 6 Abs. 1 lit. f DSGVO, with our legitimate interest in answering the matter raised. Providing your name, email address and message is necessary for us to reply; without them we cannot process the enquiry. All other fields are voluntary, and leaving them out has no disadvantage for you. Enquiry data is deleted once the matter has been dealt with and no statutory retention obligations prevent deletion; where an enquiry does not lead to a business relationship, this happens after twelve months at the latest.

To keep the contact form from being rendered unusable by automated submissions, we check submissions with Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The check runs on the contact page only. It requires no input from you and displays no widget; it runs invisibly in the background. It loads a verification script from Cloudflare which transmits the following to Cloudflare: your IP address, the TLS fingerprint of your connection, your browser identification (user agent), and this website’s sitekey together with the address the request originates from. From these it is inferred whether the submission comes from a human. Cloudflare describes the details in its “Turnstile Privacy Addendum”, available at cloudflare.com/turnstile-privacy-policy. The legal basis is Art. 6 Abs. 1 lit. f DSGVO, with our legitimate interest in protecting the contact form against automated submissions and thereby keeping it reachable. Cloudflare processes this data as a processor on our behalf; transfers to the USA are based on the EU standard contractual clauses under Implementing Decision (EU) 2021/914, which the provider’s published agreement incorporates.

8. Embedded videos

Videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and Vimeo (Vimeo.com, Inc., USA) are loaded only after they have been actively clicked or after the category “Externe Medien” has been enabled in the cookie settings. Only then is data (including your IP address as well as browser and device details) transmitted to the respective provider; YouTube is embedded in extended privacy mode (youtube-nocookie.com). The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG. Retention is governed by the providers’ own statements; we do not store any data ourselves in this context. For transfers to the USA, Vimeo relies on the EU standard contractual clauses.

9. Fonts and external content

Fonts are served locally by this website. No connection to Google Fonts or other font services is made when a page is loaded. Likewise, simply opening a page establishes no connection to the services linked in the footer and in the menu (LinkedIn, Facebook, Instagram and our customer portals); data flows only once you click such a link, and from that point the respective provider’s privacy policy applies.

10. Job applications

Application documents received by email are treated confidentially and used solely for the application procedure (Art. 6 Abs. 1 lit. b DSGVO, § 26 Abs. 1 BDSG). Documents are deleted no later than six months after the procedure has been concluded, unless consent to longer storage has been given.

11. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 Abs. 1 und 4 DSGVO does not take place. On this website we neither use scoring procedures with legal effect nor take decisions based solely on automated processing.

12. Rights of data subjects

You have the right of access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Consent that has been given can be withdrawn at any time with effect for the future (Art. 7 Abs. 3 DSGVO); the lawfulness of processing carried out until then remains unaffected. An informal message to the contact routes given under section 1 or 2 is sufficient to exercise these rights.

13. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6 Abs. 1 lit. f DSGVO. On this website this concerns the server log data (section 4), the server-side error monitoring (section 5) and the handling of general enquiries (section 7).

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, or the processing serves to establish, exercise or defend legal claims. Where data is processed for direct marketing, you may object at any time and without giving reasons; such processing will then cease.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular with the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

15. Changes

This privacy policy is updated whenever the scope of the website or the legal situation changes. The version published here, bearing the date given above, is the applicable one. If the categories or purposes of processing that require consent change, we will obtain your consent again.

Consent management, audience measurement and marketing

When you open this website, only technically necessary data is processed at first. We store your consent decision locally in your browser (localStorage, key “nms-consent”); this is not an advertising cookie. You can change or withdraw the decision at any time using the “Cookie-Einstellungen” link in the footer.

Google Tag Manager

If you consent to the category “Statistik” or “Marketing”, we load Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is not itself a measurement tool; it is the tool through which the services named below are delivered. Without your consent it is not loaded, and no connection to Google servers is made either. The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG.

Google Analytics 4 (category “Statistik”)

Through Tag Manager we load Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service measures how this website is used: which pages are opened, how long a visit lasts, by what route someone reaches us, and whether an enquiry or appointment booking results. In doing so, cookies and similar identifiers are set on your device and usage data including a truncated IP address is processed. We have enabled IP anonymisation and disabled the sharing of data with Google for its own purposes.

The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG. Without consent the service is not loaded. Usage data is deleted by Google after 14 months. Google also processes data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, so that transfers rely on the European Commission’s adequacy decision under Art. 45 DSGVO. The EU standard contractual clauses apply in addition.

Marketing tags (LinkedIn, Meta)

Only with consent to the category “Marketing” may services for measuring campaign performance be loaded through Tag Manager, in particular the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland) and the Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). In doing so, personal data such as your IP address and usage data may be transmitted to the providers and to third countries; both providers base transfers to the USA on the EU-U.S. Data Privacy Framework and, in addition, on the EU standard contractual clauses. The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. Without consent, these services are not loaded.

For the collection and transmission of the measurement data we are joint controllers with LinkedIn and Meta respectively under Art. 26 DSGVO. The providers make the essence of the respective arrangement publicly available: LinkedIn in its “Ads Data Processing Agreement” and the joint controller annex at legal.linkedin.com, Meta in the addition known as the “Controller Addendum” at facebook.com/legal/controller_addendum. Under these, the providers are responsible for the further processing and for informing data subjects; you may exercise your rights both with us and directly with the providers. According to their own statements, LinkedIn and Meta delete the collected data after 90 days and 24 months respectively.

Maps on the contact page

On our contact page you first see our own location graphic, which works without any data transfer to third parties. An interactive map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is loaded only after you have enabled it using the “Karte anzeigen” button or via the category “Externe Medien” in the cookie settings. Only from that point onwards is data (including your IP address) transmitted to Google, including to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG; you can withdraw it at any time via “Cookie-Einstellungen” in the footer. Retention is governed by Google’s own statements. Independently of this, clicking “Route planen” opens Google Maps in a new tab; from that point onwards, Google’s privacy policy applies.

Appointment booking (Calendly)

To arrange an appointment we embed the booking calendar of Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. It is loaded only after you have enabled the category “Externe Medien”; before that, no connection to Calendly is established. From that point onwards, data (including your IP address as well as browser and device details) is transmitted to Calendly, and the provider may set cookies. The legal basis for loading the calendar and for accessing your device is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG, which you can withdraw at any time via “Cookie-Einstellungen” in the footer; withdrawal takes effect for the future.

If you actually book an appointment, Calendly processes the details you enter (name, email address, chosen time and an optional message) and transmits them to us so that we can attend the appointment. The legal basis for this is Art. 6 Abs. 1 lit. b DSGVO, because this processing serves the performance of pre-contractual measures; withdrawing the consent described in the preceding paragraph does not affect it. We delete appointment details six months after the appointment unless a business relationship arises. Processing takes place in the USA. Calendly states that it relies on the EU standard contractual clauses and is certified under the EU-U.S. Data Privacy Framework; the entry can be viewed at dataprivacyframework.gov. Further information from the provider: calendly.com/legal/privacy-notice.