Privacy policy

1. Controller

The controller for the processing of personal data on this website within the meaning of the GDPR is:

No data protection officer has been appointed: the conditions of § 38 (1) BDSG are not met, as fewer than 20 people are permanently engaged in the automated processing of personal data.

2. Principles

We process personal data only as far as necessary to provide this website and to answer your enquiries. Depending on the processing, the legal basis is Art. 6 (1)(b) GDPR (contract or pre-contractual steps), Art. 6 (1)(f) GDPR (legitimate interest in a secure, functioning website) or, where applicable, Art. 6 (1)(a) GDPR (consent).

This website is served over SSL/TLS. You can tell by https:// in your browser’s address bar. Content you send us cannot readily be read by third parties in transit.

3. Hosting

This website is hosted by Vercel (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, and Vercel Germany GmbH). On our behalf, Vercel processes the data technically required to deliver the site to your browser — in particular the server log files described in the next section.

The legal basis is Art. 6 (1)(f) GDPR: we have a legitimate interest in providing our website reliably and securely. The data processing agreement under Art. 28 GDPR forms part of Vercel’s terms of service and is concluded by using the service; transfers to the USA are based on the European Commission’s standard contractual clauses contained in it.

4. Server log files

When you open this website, the host automatically records information your browser transmits:

• the URL requested and the HTTP status code
• date and time of the request
• the amount of data transferred
• browser type and version, and the operating system used
• the referrer URL — the page you came from
• your device’s IP address

This data is technically necessary to deliver the page and helps us detect faults and attacks. It is not merged with other sources, and we do not use the logs to identify individual visitors. The legal basis is Art. 6 (1)(f) GDPR. Retention follows our host’s defaults and is a matter of days.

5. Booking through Cal.com

On /en/contact you can book a slot for an intro call directly. The calendar is provided by Cal.com (Cal.com, Inc., USA) and is loaded as an embed. In doing so your IP address is transmitted to Cal.com, and Cal.com may store or read information on your device.

The calendar does not load by itself. On every other page nothing happens until you click „Open the calendar“. On the contact page it loads immediately — that page does nothing else, and you opened it in order to use exactly this service. The legal basis for the access to your device is therefore § 25 (2) no. 2 TDDDG (strictly necessary for a service you explicitly requested); for the subsequent processing, Art. 6 (1)(b) GDPR.

What you enter there goes to Cal.com and to us: name, email address, the slot chosen and anything you optionally write in the message field. Cal.com is our processor under Art. 28 GDPR; transfers to the USA are based on the European Commission’s standard contractual clauses. Cal.com’s own privacy notice applies in addition: cal.com/privacy.

Retention: we keep booking data for as long as the enquiry is live and delete it afterwards, unless statutory retention obligations apply. If a contract results, the corresponding statutory periods apply.

6. Contact by email or phone

If you write or call us directly, we process your details in order to deal with your request. The legal basis is Art. 6 (1)(b) GDPR where there is a contractual context, otherwise Art. 6 (1)(f) GDPR. We delete the message once the matter is settled and no statutory retention obligation applies. Please note that unencrypted email can be read by third parties in transit — for confidential matters, ask us for another channel.

7. Cookies and analytics

Without your agreement we set no analytics cookies. On a first visit a notice asks whether we may use Google Analytics. If you say no — or ignore the notice — the Google script is not loaded at all, no cookie is created, and no request reaches Google. There are no social network pixels and no profiling here in any case.

Your decision is remembered in your browser’s localStorage under dn-consent (the value is „granted“ or „denied“). It is not transmitted to us or to third parties. You can change it at any time: „Cookie settings“ in the footer clears it and the notice asks again — Art. 7 (3) GDPR requires withdrawal to be as easy as consent.

For reach measurement we use Vercel Web Analytics and Vercel Speed Insights, provided by our host. Both work without cookies and without storing or reading any information on your device — no consent under § 25 TDDDG is required. What is recorded is aggregate information about the page view only: page requested, referring page, country, operating system, browser and device type, plus technical load-time measurements (Core Web Vitals). No identifier attributable to a person is created: Vercel derives a hash from the IP address and further technical details that is valid for 24 hours, cannot be stored and cannot be reversed; the IP address itself is not stored. Visits across several days or several websites cannot be joined up. The legal basis is Art. 6 (1)(f) GDPR — our legitimate interest in a data-minimal picture of which content gets found and how fast the site actually loads.

Alongside it we use Ahrefs Web Analytics (Ahrefs Pte. Ltd., 16 Raffles Quay, Singapore). This tool also works without cookies and puts nothing on your device — we read the script before adding it: it contains not a single access to cookies, localStorage or sessionStorage. No consent under § 25 TDDDG is required for it. What is transmitted is the address you opened, the referring page, screen size, browser language and page title.

One difference from Vercel matters: Vercel’s script is served from our own address, this one from analytics.ahrefs.com. Opening a page therefore creates a connection to Ahrefs, and your IP address is transmitted in the process. The legal basis is Art. 6 (1)(f) GDPR. For the transfer to Singapore — a country with no adequacy decision from the European Commission — the standard contractual clauses apply.

On top of page views we count four named events, to see which pages lead to an enquiry: „booking link clicked“, „calendar opened“, „booking completed“ and „email or phone clicked“. The only thing transmitted with them is the path of the page it happened on (for example /en/blog/seo-for-saas) — with no query string — and, for a contact click, whether it was email or phone.

What is not transmitted is your name, email address, phone number, booking reference or any other value belonging to you. That applies to the booking itself in particular: Cal.com reports your details to us when it happens, and none of them reach the analytics — all that is created there is the fact that a booking took place. These events are cookieless and touch nothing on your device either; the legal basis is Art. 6 (1)(f) GDPR.

There is exactly one value on your device, and it does not survive closing the tab: a flag in sessionStorage called dn-intro-seen. It makes the home page’s short intro animation run once per session rather than on every navigation. The value is the digit 1, it is not transmitted to us or to third parties, and it allows no conclusions about you. The legal basis is § 25 (2) no. 2 TDDDG: strictly necessary for the presentation you asked for.

Nothing else — no cookies, no localStorage. Until 18 August 2026 your light or dark display preference lived here too; the switch is gone, the site now has one design, and the value went with it.

8. Google Analytics — only with consent

If you agree, we load Google Analytics 4(measurement ID G-01ESMGGQ6D) from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. We use it to see which content gets found and read.

What happens then: Google sets cookies on your device (among them _ga and _ga_G-01ESMGGQ6D, lasting up to two years) and processes, among other things, the pages you open, the referring source, your approximate location, device type, browser and your truncated IP address. A pseudonymous identifier is created that ties your visit together across page views. Transfer to Google LLC in the USA cannot be ruled out; it is based on the European Commission’s standard contractual clauses and Google’s certification under the EU-US Data Privacy Framework.

The legal basis is your consent under § 25 (1) TDDDG and Art. 6 (1)(a) GDPR. Until you give it, every Google consent signal (Consent Mode) is set to denied and the script is not loaded. Retention: the cookie lifetimes above; the reports at Google are capped at 14 months.

You can withdraw your consent at any time through „Cookie settings“ in the footer. Google additionally offers a browser add-on to opt out: tools.google.com/dlpage/gaoptout. Google’s own notice: policies.google.com/privacy.

9. Fonts and external content

All fonts are served from our own server. There is no connection to Google Fonts or any other font network. We embed external content in exactly one place — the Cal.com calendar, see above. There are no map, video or social services here that would open a connection to a third party when the page loads.

10. Recipients of your data

Apart from our host, the calendar provider Cal.com, Ahrefs, Google (only where consent was given) we do not pass personal data to third parties — unless we are legally obliged to or you have explicitly consented. We use no advertising networks, no data brokers and no lead vendors.

11. Your rights

You have the right at any time to

• access the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on Art. 6 (1)(f) GDPR (Art. 21 GDPR)
• withdraw a consent with effect for the future (Art. 7 (3) GDPR)

An informal message to hallo@denitro.de is enough.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the one at the controller’s seat — for us the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

12. Changes to this policy

We update this privacy policy whenever the website or the legal situation changes — for instance when a new tool is added. The version published here applies; the date above shows its state.