Skip to content
Nordwind
Get started

Privacy policy

Last updated:

This English version is provided for your convenience. Only the German version is legally binding.

Thank you for your interest in our website. Protecting your personal data matters to us. This page explains which data we process when you visit this website, for what purpose and on what legal basis, and what rights you have.

In short: we use no analytics or tracking tools, no advertising cookies and embed no fonts or scripts from Google. We only process data where this is necessary to run the website or when you send us something.

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

[Name or company name and legal form]
[Street and number]
[Postcode and city]
[Country]

Email: [email address]
Phone: [phone number]

You can find further details in our legal notice.

We have not appointed a data protection officer, as we are not legally required to do so (Art. 37 GDPR, Section 38 BDSG). If you have questions about data protection, please contact us directly at the address above.

Personal data is any information relating to an identified or identifiable person, such as a name, email address or IP address. We process it on the following legal bases under the GDPR:

  • Consent (Art. 6(1)(a) GDPR): you have given us consent for a specific purpose. You can withdraw it at any time with effect for the future.
  • Contract and pre-contractual measures (Art. 6(1)(b) GDPR): processing is necessary for a contract with you or to answer your enquiry before a contract.
  • Legal obligation (Art. 6(1)(c) GDPR): we are required to retain data, for example for tax reasons.
  • Legitimate interests (Art. 6(1)(f) GDPR): processing is necessary for our legitimate interests, such as operating the website securely, and your interests do not override them.

Storing information on your device or accessing it (for example cookies or local storage) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG): without your consent, this is only permitted where strictly necessary to provide a service you have explicitly requested (Section 25(2) no. 2 TDDDG).

Hosting and delivery of the website

This website is delivered via Cloudflare Workers, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare operates a worldwide network of data centres (content delivery network) that delivers the pages quickly and protects them against attacks.

When you visit the website, Cloudflare processes technically necessary data that your browser transmits automatically, in particular:

  • IP address
  • date and time of access
  • requested page or file, amount of data transferred and status code
  • referrer URL (the previously visited page), if your browser sends it
  • browser type, operating system and language setting

This data is required to deliver the website, keep it secure (for example to fend off attacks) and analyse errors. The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). We do not analyse this data ourselves or combine it with other data. How long Cloudflare retains it is governed by Cloudflare’s privacy policy.

We have concluded a data processing agreement with Cloudflare (Art. 28 GDPR). Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). In addition, Cloudflare has entered into the European Commission’s standard contractual clauses (Art. 46 GDPR).

More information: Cloudflare privacy policy

Theme setting: if you switch on the dark theme, we save this choice in your browser’s local storage (entry theme with the value dark or light). It stays on your device, is not sent to us and contains no personal data. It is required for the function you have requested (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

Fonts: the fonts used (Schibsted Grotesk and Familjen Grotesk) are hosted on our own web space. No connection to Google or other font providers is made when a page loads.

Blog search: the blog search runs entirely in your browser. The search index is loaded from our website; your search terms are not sent to us or to third parties.

Preloading pages: to make pages appear faster, your browser may load a page of our website as soon as you hover over a link. Only content from our own website is requested, with the same data as a normal page view (see “Hosting”).

We do not use cookies on the public pages. Only the client area sets a technically necessary cookie after you sign in (see “Client area”).

Contact form

When you write to us using the contact form, we process the details you enter:

  • name and email address (required)
  • subject, services you are interested in, and your message
  • the language of the website
  • whether you would like a copy of your message

Your message is not stored in a database but forwarded to us as an email. For this we use the email service Brevo (see “Sending emails via Brevo”). If you select “Send me a copy of my message”, we also send a copy of your message to the email address you entered.

The purpose is to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or its preparation; otherwise your agreement, which you give via the checkbox (Art. 6(1)(a) GDPR), and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Spam protection: to block automated mass submissions, we check when the form is submitted how long it was open, a field that is invisible to people, and the origin of the request. We also use Cloudflare Turnstile (see below). These checks take place at the moment of submission; no additional data is stored. The legal basis is our legitimate interest in a functional contact channel protected against abuse (Art. 6(1)(f) GDPR).

Retention: your enquiry is then kept in our email inbox. We delete it once it has been fully dealt with and no further communication is expected, but no later than six months after the last contact. If your enquiry leads to an assignment, we keep the related correspondence for as long as statutory retention periods require: business letters for six years, documents relevant for tax purposes such as invoices for eight to ten years (Section 257 HGB, Section 147 AO).

Job applications

We publish job openings on our website. You can apply via the contact form (topic “Job application”) or by email to the contact person named in the job opening. We process the details you send us, in particular your name, email address, message and links to work samples, and, if you apply by email, attached documents such as your CV and references.

Applications sent via the contact form reach us as an email via Brevo, like other enquiries (see “Contact form” and “Sending emails via Brevo”); applications sent by email go directly to our inbox. Only the people involved in the selection can see them.

Purpose and legal basis: we process your data to decide on your application and on entering into an employment relationship. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into an employment contract). If you voluntarily share special categories of personal data with us (for example a severe disability), we only process them where necessary for the decision or for reasons of employment law (Art. 9(2)(b) GDPR).

Retention: if you are hired, we add the documents required for the employment relationship to your personnel file. If we decline your application or you withdraw it, we delete your data six months after the end of the process. We keep it for this period so that we can defend ourselves against possible claims under the German General Equal Treatment Act (Sections 15(4) and 22 AGG; Art. 6(1)(f) GDPR). If you would like to be considered for future positions, we will ask for your consent first (Art. 6(1)(a) GDPR); you can withdraw it at any time.

Job openings as PDF: you can download every job opening as a PDF. The PDF is an ordinary file on our website; downloading it only involves the data processed for every page view (see “Hosting”).

Newsletter

You can subscribe to our newsletter on this website. All we need is your email address.

We use a double opt-in process: after subscribing, you receive an email with a confirmation link. You are only added to the mailing list once you click it. This ensures that nobody can subscribe with someone else’s email address. We log the time of subscription and confirmation and the IP address used, so that we can prove the subscription.

The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR). We log the subscription because we have to be able to prove consent (Art. 7(1) GDPR, Art. 6(1)(c) GDPR) and in our legitimate interest in sending it in a legally compliant way (Art. 6(1)(f) GDPR).

Unsubscribing: you can unsubscribe at any time using the link at the end of every issue or by sending us a message, thereby withdrawing your consent. This does not affect the lawfulness of emails sent up to that point.

Retention: your email address remains on the list until you unsubscribe. If you do not confirm your subscription, it is deleted after [period, e.g. 30 days]. After you unsubscribe, we keep the address and the record of your previous consent for up to three years (standard limitation period under Section 195 BGB) so that we can prove your earlier consent. This data is then only used for that purpose and blocked for mailings. If you never want to receive the newsletter again, we can additionally add your address to a block list on request.

We also use Brevo for the newsletter. [If enabled: Brevo records whether and when a newsletter was opened and which links were clicked. This analysis helps us improve our newsletter and is based on your consent to receive the newsletter. Brevo does not offer a separate objection to the analysis only; to stop it, you can unsubscribe from the newsletter.]

Client area

We run a protected client area for our clients at /en/client-area/. Only people we invite get access; there is no public sign-up.

What data we process

  • Account: name, email address, preferred language, company, a password hash (we do not store the password itself) and the time of the last sign-in.
  • Project data we maintain for you: project status, milestones, open items, notes and files to download.
  • Your contributions: comments on your projects (text, name, time and, if chosen, the open item or file they refer to) and open items you report as done (who, when). When a comment is deleted, we clear its text; only the note “Comment deleted” remains.
  • Your files and approvals: files you upload (content, file name, size, description, who and when and, if chosen, the open item they belong to), at most 2 GB per company. As long as we have not downloaded a file, you can delete it yourself. When you approve a file or request changes, we store the decision with name, time and comment as a record (not a legally binding signature).
  • Appointments, quotes and invoices: appointments we enter for you (title, time, duration, location, link, note and, if so, a cancellation) and quotes and invoices we upload as PDF files (number, title, amount, date, due date or validity, payment or acceptance status). You download appointments as a calendar file (ICS) yourself if you want to; we do not add anything to your calendar. We keep invoices as long as tax and commercial law require.
  • Sessions: time of sign-in and last use, IP address and browser identifier (user agent). You can see your signed-in devices on the account page and sign them out there.
  • Activity log: sign-ins, sign-outs, password changes, downloads (which file, when, by whom) as well as uploads and approvals. This lets us check whether a file has arrived and detect misuse. You can see at the file when we have downloaded a file you uploaded.

After you sign in, we set the cookie nordwind-session. It only contains a random identifier of your session, is technically necessary and is not used for advertising or analytics. It expires 14 days after your last visit or when you sign out. This cookie does not require consent (Section 25(2) no. 2 TDDDG).

Where the data is stored

The data is stored in a database (Cloudflare D1) and a file storage (Cloudflare R2) of our hosting provider Cloudflare (see “Hosting and delivery of the website”). We have set Eastern Europe (EU) as the storage location. Content is delivered via Cloudflare’s worldwide network, which may involve a transfer to the USA (see there for the legal basis). Content of the client area is not stored in the website’s content management system.

Emails

We send invitations, password reset links and – if we choose to in a given case – notices about news in your project via Brevo (see “Sending emails via Brevo”). When you write a comment, report an item as done, upload a file or decide on an approval, we also receive an email about it via Brevo, with your name and the comment, the title of the item or the file name (not the file itself).

Spam protection

The “Sign in” and “Forgot password” forms are protected by Cloudflare Turnstile (see “Spam protection with Cloudflare Turnstile”). We also limit the number of attempts per IP address; we do not store the IP address permanently for this.

The legal basis is the performance of our contract with you or your company (Art. 6(1)(b) GDPR); for the activity log and session data also our legitimate interest in a secure client area (Art. 6(1)(f) GDPR).

Sessions are deleted when they expire, invitation and password links after they expire or have been used (in each case by the following day at the latest). Activity log entries are deleted automatically after twelve months, as is the administrative data of deleted files (the files themselves are deleted immediately). We delete the account, project data, files, contributions and appointments when our collaboration ends, at the latest six months afterwards. Quotes and invoices that we have to keep under tax and commercial law are then only kept outside the client area.

For safety, we create a backup copy of the database (without files) in the same file storage every week and keep it for eight weeks; in addition, the database can be restored to any point in the past 30 days. Deleted data may therefore remain in backups for up to eight weeks, but is not used from there except to restore the latest state after a failure.

Spam protection with Cloudflare Turnstile

We protect the contact form, the newsletter sign-up and the client area’s sign-in and “Forgot password” forms with Cloudflare Turnstile (provider: Cloudflare, see “Hosting”). Turnstile checks whether a request comes from a person or from an automated program. Turnstile is only loaded when you click into the respective form or move into it with the keyboard – not when the page is opened.

To do this, your browser loads a script from challenges.cloudflare.com. Turnstile processes in particular your IP address and information about your browser, device and interaction with the page. The check usually runs invisibly in the background; you are only asked for a short confirmation when necessary. On submission, our server verifies the result with Cloudflare.

The legal basis is our legitimate interest in protecting our forms against abuse and spam (Art. 6(1)(f) GDPR). Access to information on your device is strictly necessary for submitting the form as you requested (Section 25(2) no. 2 TDDDG). For data transfers to the USA, see “Hosting”.

More information: Cloudflare Turnstile privacy addendum

Sending emails via Brevo

We use Brevo to send the emails from the contact form, the newsletter and the client area. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo processes the data required for sending (for enquiries, the content of the message including name and email address; for the newsletter, your email address and the sign-up log data) on our behalf. We have concluded a data processing agreement with Brevo (Art. 28 GDPR). Brevo keeps sending logs (recipient, time, delivery status) for [period according to Brevo, e.g. up to 30 days]. The legal bases are set out in the sections “Contact form”, “Newsletter” and “Client area”.

More information: Brevo privacy policy

Office map and directions

The map of our offices on the jobs and contact pages is a graphic served from our own server. Displaying it makes no connection to Google or any other map service.

The “Get directions” links are ordinary links: Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) only opens in a new tab when you click one, and Google’s privacy policy then applies.

More information: Google privacy policy

Our website contains links to other websites, for example to LinkedIn profiles on our team page. These are plain links, not embedded content or “social plugins”: no data is transferred until you click a link. The operators of the linked sites are responsible for them.

The “Share” function on blog articles uses your device’s share feature or copies the link to your clipboard. No data is sent to us or to social networks unless you choose a service to share with yourself.

Your rights

You have the following rights regarding your personal data:

  • Access to the data we process (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR), unless we are legally required to retain the data
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, simply send an informal message to the contact details given under “Controller”.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or of the alleged infringement. The authority responsible for us is:

[Name of the state data protection authority at the controller’s location]
[Address]
[Website]

Obligation to provide data and automated decisions

You are not legally or contractually obliged to provide us with personal data. However, without a name and email address we cannot answer an enquiry sent via the contact form, and without an email address we cannot send you the newsletter. For a job application, we need the details required for the decision; without them, we cannot consider your application.

There is no automated decision-making, including profiling (Art. 22 GDPR).

Security

This website is delivered exclusively over encrypted HTTPS connections, so data you send to us cannot be read by third parties in transit.

Changes to this privacy policy

We update this privacy policy when the website, the services we use or the legal situation change. The version published here applies; its date is shown below the title.