Privacy Policy
Last updated: 2026-07-27 · Consent copy version: 2026-07-v1
1. Controller
This website is operated by the owner under the trading name Nexorare as a sole proprietorship (Einzelunternehmen) in Germany. The owner is the controller for the processing described on this website.
Owner's legal name will be inserted before production launch.
Public contact details:
Eichenberg 45 45473 Mülheim an der Ruhr Germany
Imprint for the full legal notice.
2. What we process
This section describes processing supported by the current application — not hypothetical third-party tools.
- Contact form — name, email, optional company / subject, message; consent checkbox; honeypot field (not processed as content); rate limiting; optional hashed IP and user-agent metadata for abuse prevention when stored.
- Quote form — project details you submit plus the same consent, honeypot and rate-limit protections.
- MySQL lead storage — when the database is configured, enquiries and consent audit rows are stored (consent type, text version, timestamp, source; no email in the consent table).
- SMTP delivery — when SMTP is configured, acknowledgement or notification mail may be sent. If neither database nor SMTP is available, the form shows a temporary service error (no false success in production).
- Newsletter signup — email and marketing consent when you subscribe in the footer. Subscriptions are stored as pending until an owner-approved activation / confirmation workflow is operated. There is no automatic mailing campaign in this codebase.
- Theme preference — stored in the browser via
localStorage(nexorare-theme), not as a tracking cookie. - Optional analytics — Umami loads only when both environment variables are set and you accept analytics consent. See Cookies.
- Server logs — standard web-server and application error logs may record technical events. Operational logging must not intentionally store form body PII in application logs.
3. Purposes
- Respond to contact and quote enquiries
- Operate the website securely (rate limits, honeypot, error handling)
- Record consent evidence for form and newsletter actions
- Send transactional acknowledgements when SMTP is configured
- Store newsletter interest as pending until activation is configured
- Measure aggregate traffic only with analytics consent when Umami is configured
4. Legal bases (draft)
Draft mapping for counsel review — not a compliance certification:
- Art. 6(1)(b) GDPR — pre-contractual steps for contact / quote enquiries
- Art. 6(1)(f) GDPR — security and abuse prevention (legitimate interests)
- Art. 6(1)(a) GDPR — newsletter signup and optional analytics (consent), where used
5. Retention
Soft retention helpers exist in application code (default target: 24 months via LEAD_RETENTION_MONTHS). Automated scheduled deletion is not yet an owner-approved production job
. Final retention and deletion rules require an owner decision and legal review.
6. Recipients and hosting
Depending on configuration, processors may include the MySQL host, the SMTP provider, and the website hosting provider (Hetzner Online GmbH — see Imprint). No advertising pixels or session-replay tools are shipped in this codebase.
7. Your rights
Under applicable data-protection law you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may also lodge a complaint with a supervisory authority. Contact info@nexorare.com.
8. Cookies and local storage
See the cookie information page for essential storage, analytics consent behaviour and how to change preferences.
9. Security note
We apply practical safeguards (validation, rate limits, honeypot, separation of secrets from the client). This is not a claim of absolute security, certification or guaranteed encryption outcomes.