Privacy Notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for data processing on this website is:

NESS Online GmbH
Ober-Laudenbacher Str. 56c
64646 Heppenheim
Germany

Represented by: Hannes Schubert
Email: contact@420-plus.com
Phone: +49 160 985 345 11

Please address data protection requests to the contact details above.

2. Scope and Distinction from the 420+ Portal

This notice applies to visits to the website 420-plus.com in German and English and to demo and contact requests you send to NESS Online GmbH via this website, by email or by phone.

It does not apply to the use of the 420+ software (the “portal”) or to portal instances that customer organisations operate under their own name and on their own domains (white-label instances). The respective customer organisation is the controller for processing in such instances, and its privacy notice applies. Section 7 describes the role of NESS Online GmbH in this context.

3. Hosting and Server Log Data

The website is hosted by Vercel Inc. (USA) on the Pro plan. The server-side contact form function runs in the Frankfurt am Main region (fra1). Static content is delivered through Vercel’s global content delivery network (CDN).

When a page is requested, Vercel processes technical access data: IP address, date and time of access, requested page or file, data volume transferred, browser type and version, operating system, referrer URL, and technical error and security information. This processing serves to deliver the website, maintain its stability and security, and detect attacks and errors. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. Processing on our behalf takes place under Article 28 GDPR on the basis of the Vercel Data Processing Addendum (DPA).

4. Demo and Contact Requests

You can request a product demonstration via the demo form on the start page. The following data is processed: first and last name, email address, organisation or company, phone number (optional), market or regulated context, role or organisation type (optional), project stage (optional), your description of the process to be mapped and the modules you select. To block automated submissions, the form contains a check field that is invisible to humans and a timestamp of when the form was started; this data is used solely for spam detection.

Your details are sent by the server-side function using Nodemailer via the SMTP service of checkdomain GmbH over an encrypted TLS connection to the mailbox of NESS Online GmbH and used there to process your request, arrange an appointment and conduct pre-contractual communication. The legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract) and, as regards spam protection and the documentation of business contacts, Article 6(1)(f) GDPR. The same applies to requests you send by email or phone.

Confirming the privacy notice in the form serves to inform you; the processing of your details rests on the legal bases stated above, not on consent.

The form does not store your details in a database or CRM system and does not set cookies or use tracking.

5. Cookies, Analytics and Tracking

The website does not set cookies for analytics, marketing or tracking purposes and does not embed external analytics, font or map services. No usage profiles are created, and no consent banner is therefore required. Should the website use cookies or comparable technologies under Section 25 TDDDG in future, this notice will be updated beforehand and, where required, your consent obtained.

6. External Links

The website contains links to external content, such as technical sources, standards and the LinkedIn profile of the managing director. Linked content is not embedded in our pages; when you follow a link you leave our site. The respective provider is responsible for data processing on linked pages.

7. 420+ Portal and White-Label Instances

NESS Online GmbH provides the 420+ software to customer organisations, in some cases as a white-label instance under the customer organisation’s own name and domain. Data processing in such instances is not covered by this notice. The privacy notice of the respective customer organisation applies; the role of NESS Online GmbH follows from its contract with the customer organisation.

Public search functions, public profiles and requests from prospects to a customer organisation are offerings of that customer organisation on its own domain. NESS Online GmbH does not operate its own referral or lead business for such requests. Data subjects should contact the respective customer organisation for information about these offerings.

8. Recipients and Transfers to Third Countries

Recipients of personal data are Vercel Inc. as the hosting provider, checkdomain GmbH as the email service provider, and public authorities where disclosure is required by law. Email processing by checkdomain takes place on servers in Germany.

Vercel Inc. is based in the USA and operates a global CDN. Processing therefore also includes transfers of personal data to third countries. These transfers are covered by the EU standard contractual clauses included in the Vercel DPA as appropriate safeguards under Article 46 GDPR. Information about these safeguards and a copy are available through the contact details in Section 1.

9. Retention

Emails from demo and contact requests are deleted after the request has been concluded, and no later than twelve months after the last contact. Documents arising during pre-contractual dealings or a contractual relationship that are subject to statutory retention obligations are retained for the applicable periods under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO). The legal basis for this retention is Article 6(1)(c) GDPR.

Technical function logs are retained by Vercel for one day under the Pro plan used. We do not transfer these logs to our own systems.

10. Rights of Data Subjects

Under the GDPR you have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21). To exercise your rights, a message to the contact address in Section 1 is sufficient.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Article 77 GDPR). The authority competent for NESS Online GmbH is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, HBDI), Wiesbaden.

12. No Automated Decision-Making

NESS Online GmbH does not make decisions on this website based solely on automated processing and does not carry out profiling within the meaning of Article 22 GDPR.

13. Changes to this Notice

We will update this privacy notice if the website, the services used or the legal situation change. The current version is available at 420-plus.com/datenschutz-en; the version date is stated above.