Privacy Policy

Version: 10 August 2026 · Edition 4

This is the English edition of our privacy policy. It is intended to be complete and correct on its own. References to legal provisions are given in their German citation form, followed by the English name of the act, because they refer to German and European law: DSGVO is the General Data Protection Regulation (GDPR), TDDDG the German Telecommunications Digital Services Data Protection Act, BDSG the German Federal Data Protection Act, and DDG the German Digital Services Act.

1. Controller

New Media Service GmbH

Hegau-Tower, Maggistraße 5, 12th floor, 78224 Singen (Hohentwiel), Germany

Phone: +49 7731 969390 · Email: info@nms.de

2. Data protection officer

Our data protection officer is Gerhard Söbbing. You can reach him directly and confidentially at datenschutz@nms.de, or by post at the address above marked “Vertraulich – Datenschutzbeauftragter”. Messages sent this way are not seen by other parts of the company.

3. Principles

Personal data is processed only where this is necessary to provide this website, to answer enquiries, or to comply with legal obligations. Without your consent, no audience measurement and no advertising-related tracking takes place; the corresponding cookies are not set and no data is transmitted to the providers concerned. What else you can enable, and what it does, is described below under “Consent management, audience measurement and marketing”.

4. Hosting and server log data

This website is operated by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through a global content delivery network. The application database is provided by Neon, LLC, a company of Databricks, Inc. (USA), and stored in the AWS data centre in Frankfurt (region eu-central-1). When the website is accessed, the host processes technically necessary server log data (IP address, date and time, page requested, user agent) in order to deliver the website and to ensure the security of its operation. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest lies in secure and reliable operation. Both providers process this data as processors under Art. 28 DSGVO on our behalf.

Transfers to the USA are based, for both providers, on the EU standard contractual clauses under Implementing Decision (EU) 2021/914 in conjunction with the providers’ published data processing agreements. No adequacy decision under Art. 45 DSGVO is relied upon for these transfers. A copy of these safeguards is available on request via the contact details given under section 1; this also applies to all providers named below. Server log data is deleted after 30 days at the latest.

Audience measurement via Vercel. In addition to the server log data, we use Vercel Web Analytics to count how often each page is called up, without cookies and without consent. The recipient is the same Vercel Inc. that operates this website; processing on our behalf, transfer to the USA and the safeguards that apply are described above in this section. No information is stored on your device, and no information already stored there, such as cookies, is read; in our assessment Section 25(1) TDDDG therefore does not apply. Your IP address is processed: from it and from further details of the request, Vercel forms a checksum for recognising a visit and derives the location from it. According to Vercel, this checksum is discarded after 24 hours and the IP address is not stored (state of the provider documentation: 26 June 2026). What is stored: timestamp, page called up, referrer, country, region and city, operating system, browser and device type; this data can be analysed for 12 months. Before sending, we remove everything from the question mark and from the hash onwards. Click identifiers from ads such as "gclid" and search terms from the site search therefore do not reach the audience measurement; that the full address arrives as server log data at the host when the page is called up is described above in this section. There is no recognition across other websites. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in seeing which content is found and read. You may object to this processing under Art. 21 GDPR, in writing to the address given under section 1. We state plainly what that means: because the measurement does not recognise you, we cannot exclude you individually from future counts. You can prevent the measurement effectively by blocking the script in your browser, for example with a content blocker.

5. Error and stability monitoring (Sentry)

So that faults on this website can be detected and fixed, we use Sentry, a service of Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Data is sent to an endpoint in Germany; the recipient, and therefore the relevant legal entity, is nevertheless the US company, because access from there cannot be ruled out. Transfers are based on the EU standard contractual clauses under Implementing Decision (EU) 2021/914.

We distinguish two cases. On the server, monitoring runs independently of your consent: it processes technical error data, in particular the error message, its location in the program code and the time it occurred, together with a sampled share of performance data. Request contents, cookies, headers and query strings are removed before transmission, and the option to transmit personal details is switched off. The legal basis is Art. 6 Abs. 1 lit. f DSGVO; our legitimate interest lies in detecting faults that would otherwise affect visitors without us hearing about them. In the browser, monitoring runs only after your consent to the category “Statistik”; without consent it is not started and no connection is established.

Error data is deleted after 90 days.

6. Cookies and local storage

Without your consent, this website uses only technically necessary storage: the session management of the system and the local storage of your cookie decision (localStorage, entry “nms-consent”). The legal basis is § 25 Abs. 2 TDDDG in conjunction with Art. 6 Abs. 1 lit. f DSGVO. Optionally, and only with your consent, three categories are added: “Statistik” (audience and error measurement), “Marketing” (remarketing) and “Externe Medien” (videos, location map, appointment calendar). The legal basis for these is Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG. The category names appear in German because that is how they are labelled in the consent dialogue.

The entry named above stores your selection of the three categories, the time of the decision and the version of the consent text, so that we can demonstrate and respect your decision. The entry has no fixed expiry date; it remains until you change your decision or clear your browser storage. However, if the categories or purposes change, an earlier consent no longer applies and you will be asked again. Using the “Cookie-Einstellungen” link in the footer, you can withdraw your consent at any time, as easily as you gave it; withdrawal takes effect for the future.

7. Contact form and email contact

When you use the contact form, the data you provide (name, company, email address, optionally phone number, message) is processed in order to handle your enquiry and stored in our content management system. Email is sent via Mailgun Technologies, a service of the Sinch group; our account is configured so that delivery runs through servers in the EU region. The provider processes this data as a processor on our behalf. For transfers to third countries, the provider’s published agreements provide for the EU standard contractual clauses under Implementing Decision (EU) 2021/914.

For enquiries directed at a contract, the legal basis is Art. 6 Abs. 1 lit. b DSGVO (pre-contractual measures); for other enquiries it is Art. 6 Abs. 1 lit. f DSGVO, with our legitimate interest in answering the matter raised. Providing your name, email address and message is necessary for us to reply; without them we cannot process the enquiry. All other fields are voluntary, and leaving them out has no disadvantage for you. Enquiry data is deleted once the matter has been dealt with and no statutory retention obligations prevent deletion; where an enquiry does not lead to a business relationship, this happens after twelve months at the latest.

To keep the contact form from being rendered unusable by automated submissions, we check submissions with Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The check runs on the contact page only. It requires no input from you and displays no widget; it runs invisibly in the background. It loads a verification script from Cloudflare which transmits the following to Cloudflare: your IP address, the TLS fingerprint of your connection, your browser identification (user agent), and this website’s sitekey together with the address the request originates from. From these it is inferred whether the submission comes from a human. Cloudflare describes the details in its “Turnstile Privacy Addendum”, available at cloudflare.com/turnstile-privacy-policy. The legal basis is Art. 6 Abs. 1 lit. f DSGVO, with our legitimate interest in protecting the contact form against automated submissions and thereby keeping it reachable. Cloudflare processes this data as a processor on our behalf; transfers to the USA are based on the EU standard contractual clauses under Implementing Decision (EU) 2021/914, which the provider’s published agreement incorporates.

8. Embedded videos

Videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and Vimeo (Vimeo.com, Inc., USA) are loaded only after they have been actively clicked or after the category “Externe Medien” has been enabled in the cookie settings. Only then is data (including your IP address as well as browser and device details) transmitted to the respective provider; YouTube is embedded in extended privacy mode (youtube-nocookie.com). The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG. Retention is governed by the providers’ own statements; we do not store any data ourselves in this context. For transfers to the USA, Vimeo relies on the EU standard contractual clauses.

9. Fonts and external content

Fonts are served locally by this website. No connection to Google Fonts or other font services is made when a page is loaded. Likewise, simply opening a page establishes no connection to the services linked in the footer and in the menu (LinkedIn, Facebook, Instagram and our customer portals); data flows only once you click such a link, and from that point the respective provider’s privacy policy applies.

10. Job applications

Application documents received by email are treated confidentially and used solely for the application procedure (Art. 6 Abs. 1 lit. b DSGVO, § 26 Abs. 1 BDSG). Documents are deleted no later than six months after the procedure has been concluded, unless consent to longer storage has been given.

11. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 Abs. 1 und 4 DSGVO does not take place. On this website we neither use scoring procedures with legal effect nor take decisions based solely on automated processing.

12. Rights of data subjects

You have the right of access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Consent that has been given can be withdrawn at any time with effect for the future (Art. 7 Abs. 3 DSGVO); the lawfulness of processing carried out until then remains unaffected. An informal message to the contact routes given under section 1 or 2 is sufficient to exercise these rights.

13. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6 Abs. 1 lit. f DSGVO. On this website this concerns the server log data (section 4), the server-side error monitoring (section 5) and the handling of general enquiries (section 7).

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, or the processing serves to establish, exercise or defend legal claims. Where data is processed for direct marketing, you may object at any time and without giving reasons; such processing will then cease.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular with the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

15. Changes

This privacy policy is updated whenever the scope of the website or the legal situation changes. The version published here, bearing the date given above, is the applicable one. If the categories or purposes of processing that require consent change, we will obtain your consent again.

Consent management, audience measurement and marketing

When you open this website, only technically necessary data is processed at first. We store your consent decision locally in your browser (localStorage, key “nms-consent”); this is not an advertising cookie. You can change or withdraw the decision at any time using the “Cookie-Einstellungen” link in the footer.

Google Tag Manager

If you consent to the category “Statistik” or “Marketing”, we load Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is not itself a measurement tool; it is the tool through which the services named below are delivered. Without your consent it is not loaded, and no connection to Google servers is made either. The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG.

Google Analytics 4 (category “Statistik”)

Through Tag Manager we load Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service measures how this website is used: which pages are opened, how long a visit lasts, by what route someone reaches us, and whether an enquiry or appointment booking results. In doing so, cookies and similar identifiers are set on your device and usage data including a truncated IP address is processed. We have enabled IP anonymisation and disabled the sharing of data with Google for its own purposes.

The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG. Without consent the service is not loaded. Usage data is deleted by Google after 14 months. Google also processes data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, so that transfers rely on the European Commission’s adequacy decision under Art. 45 DSGVO. The EU standard contractual clauses apply in addition.

Google Ads and conversion measurement

We run ads through Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To see which ad led to an enquiry, we use Google Ads conversion tracking. It loads only once you have consented to the “Marketing” category.

If you reach this website through one of our ads, Google appends a click identifier to the address (the GCLID). If you then submit the contact form or book an appointment, your browser calls a counting address at Google.

The following is transmitted to Google in the process: the click identifier, identifiers from the cookies named below, the address of the page called up, technical details about your device and browser such as screen size, operating system and browser version, a timestamp, and the name of the event triggered. As with any request on the internet, Google also receives your IP address. What you enter in the form, that is name, company, email address and anything you add voluntarily, reaches us. Of these, only the checksum of your email address described in the paragraph below is transmitted to Google; the remaining details are not. We verified this against the outgoing requests on 22 August 2026. Conversely, we receive no information about you personally from Google, only reports on how many enquiries can be traced back to which ad.

Enhanced conversions. So that an enquiry can be matched to an ad click even when the click identifier has been lost, we additionally transmit a checksum of your email address to Google. The checksum is computed in your browser (SHA-256); as information about you personally we transmit only that value, never your address in plain text. The technical details listed in the paragraph above arise alongside it, as they do with any request on the internet; added to that is an identifier for the form the enquiry came from. Other details from the form, such as name, company or telephone number, are not used for this purpose, and we transmit no such data when you book an appointment through the calendar.

A checksum is not encryption. It cannot be reversed directly, but anyone who knows or guesses the same address can compute the same value and match it. It therefore remains personal data and we treat it as such. Google matches the value against signed-in Google accounts and reports back to us how many enquiries can be traced to which ad; we receive no information about individual people. Technically the checksum travels with the Google tag, which also serves Google Analytics; it is used solely for enhanced conversions in Google Ads. User-provided data collection in Google Analytics is switched off on our property, as is the automatic reading of names, telephone numbers and addresses from the page. For enhanced conversions Google acts expressly as a processor under its customer data terms. Recipient, transfer to the United States, retention, legal basis and withdrawal of consent are the same as for the rest of the conversion tracking; the details are set out further down in this section.

So that an ad click and a later enquiry can be matched to each other, the conversion linker stores two cookies on nms.de: “_gcl_au” and “_gcl_aw”, each with a lifetime of up to 90 days. Both are stored on our own domain and used for Google Ads. In addition, Google sets its own cookies on google.com, doubleclick.net and googleadservices.com when its services are called; it does so on its own responsibility.

The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. As long as you have not consented to the “Marketing” category, no Google Ads tag is loaded, no counting address is called and none of these cookies is set. You may withdraw your consent at any time with effect for the future via the “Cookie settings” link at the foot of every page; you can additionally delete cookies already set in your browser. The lawfulness of processing carried out before withdrawal remains unaffected.

Google processes the transmitted data partly on our behalf under Google’s data processing terms and partly on its own responsibility for its own purposes. Processing also takes place in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has established an adequate level of protection, and the Commission’s standard contractual clauses apply in addition. The identifiers in the cookies named above expire after 90 days at the latest; how long Google retains the transmitted data beyond that is governed by Google’s own retention periods. Details are set out in Google’s privacy policy at policies.google.com/privacy.

Marketing tags (LinkedIn, Meta)

Only with consent to the category “Marketing” may services for measuring campaign performance be loaded through Tag Manager, in particular the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland) and the Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). In doing so, personal data such as your IP address and usage data may be transmitted to the providers and to third countries; both providers base transfers to the USA on the EU-U.S. Data Privacy Framework and, in addition, on the EU standard contractual clauses. The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. Without consent, these services are not loaded.

For the collection and transmission of the measurement data we are joint controllers with LinkedIn and Meta respectively under Art. 26 DSGVO. The providers make the essence of the respective arrangement publicly available: LinkedIn in its “Ads Data Processing Agreement” and the joint controller annex at legal.linkedin.com, Meta in the addition known as the “Controller Addendum” at facebook.com/legal/controller_addendum. Under these, the providers are responsible for the further processing and for informing data subjects; you may exercise your rights both with us and directly with the providers. According to their own statements, LinkedIn and Meta delete the collected data after 90 days and 24 months respectively.

Maps on the contact page

On our contact page you first see our own location graphic, which works without any data transfer to third parties. An interactive map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is loaded only after you have enabled it using the “Karte anzeigen” button or via the category “Externe Medien” in the cookie settings. Only from that point onwards is data (including your IP address) transmitted to Google, including to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG; you can withdraw it at any time via “Cookie-Einstellungen” in the footer. Retention is governed by Google’s own statements. Independently of this, clicking “Route planen” opens Google Maps in a new tab; from that point onwards, Google’s privacy policy applies.

Appointment booking (Calendly)

To arrange an appointment we embed the booking calendar of Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. It is loaded only after you have enabled the category “Externe Medien”; before that, no connection to Calendly is established. From that point onwards, data (including your IP address as well as browser and device details) is transmitted to Calendly, and the provider may set cookies. The legal basis for loading the calendar and for accessing your device is your consent under Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG, which you can withdraw at any time via “Cookie-Einstellungen” in the footer; withdrawal takes effect for the future.

If you actually book an appointment, Calendly processes the details you enter (name, email address, chosen time and an optional message) and transmits them to us so that we can attend the appointment. The legal basis for this is Art. 6 Abs. 1 lit. b DSGVO, because this processing serves the performance of pre-contractual measures; withdrawing the consent described in the preceding paragraph does not affect it. We delete appointment details six months after the appointment unless a business relationship arises. Processing takes place in the USA. Calendly states that it relies on the EU standard contractual clauses and is certified under the EU-U.S. Data Privacy Framework; the entry can be viewed at dataprivacyframework.gov. Further information from the provider: calendly.com/legal/privacy-notice.