privacy policy

As of: October 2026

1. Scope

This privacy policy applies to the online services of Die Nervenretter, in particular to

https://www.nervenretter.com/

as well as to the Nervenretter security archive at

https://sicherheit.nervenretter.com/.

Where individual services are only used on one of the services mentioned, we point this out in the respective section.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Die Nervenretter – Patrick Heindorf, Am Bergmoos 7a, 85414 Kirchdorf, Germany

Email: info@nervenretter.com

The controller decides alone or jointly with others on the purposes and means of processing personal data.

3. General information on data processing

We only process personal data insofar as this is necessary to provide our online services, to handle enquiries, to carry out pre-contractual measures or contracts, to ensure technical security or on the basis of consent.

Depending on the processing, we rely in particular on the following legal bases:

Art. 6 (1) (a) GDPR for consent, Art. 6 (1) (b) GDPR for contracts or pre-contractual enquiries, Art. 6 (1) (c) GDPR for legal obligations and Art. 6 (1) (f) GDPR for legitimate interests, in particular in the secure, stable and economical provision of our services.

Where information is stored on or read from the user's device, the requirements of Section 25 TDDDG also apply. Cookies or comparable technologies that are not technically necessary are generally only used after consent has been given.

4. Storage period

We generally only store personal data for as long as is necessary for the respective processing purpose.

Where statutory retention obligations exist, we store the relevant data for the period prescribed by law. Once the purpose of processing no longer applies or the statutory retention periods have expired, the data is deleted unless there is another legal basis for storing it.

5. Your rights

Within the scope of the statutory requirements, data subjects have in particular the right to information, rectification, erasure, restriction of processing, data portability and objection to certain processing.

Consent given can be withdrawn at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

If personal data is processed on the basis of Art. 6 (1) (f) GDPR, there is a right to object under Art. 21 GDPR on grounds relating to the particular situation of the data subject. Processing for direct marketing purposes can be objected to at any time.

In addition, there is a right to lodge a complaint with a data protection supervisory authority. For non-public companies based in Bavaria, the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, is responsible in particular.

6. SSL or TLS encryption

Our websites use SSL or TLS encryption.

This protects data transmitted between your browser and our systems against unauthorised reading during transmission in accordance with the state of the art.

7. Hosting of the website at Cloudflare

Our website www.nervenretter.com is provided via Cloudflare Workers. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The website consists of static pages; content is delivered via Cloudflare's worldwide network, usually from a data centre near you.

When the site is accessed, technically necessary connection data is processed, in particular IP address, time of access, requested URL, referrer and browser and operating system information. The processing serves the secure, fast and stable provision of the website and the defence against attacks on the basis of Art. 6 (1) (f) GDPR.

A data processing agreement in accordance with Art. 28 GDPR (Data Processing Addendum) has been concluded with Cloudflare. For transfers to the USA, Cloudflare relies on certification under the EU-U.S. Data Privacy Framework and additionally on standard contractual clauses.

8. Other Cloudflare services and the Nervenretter security archive

For the technical provision and protection of our services and in particular of the Nervenretter security archive at sicherheit.nervenretter.com, we use services of

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

In particular, Cloudflare DNS, Cloudflare Workers and Cloudflare D1 are used.

When the services are accessed, technically necessary data may be processed, in particular IP address, time and type of access, URL accessed, HTTP headers, browser information and other technical connection data.

The processing serves to provide and secure our services, to detect misuse and to ensure their stability on the basis of Art. 6 (1) (f) GDPR.

Cloudflare processes certain customer and content data as a processor. Cloudflare provides a Data Processing Addendum for this purpose. For transfers to the USA, Cloudflare states that it relies, among other things, on its certification under the EU-U.S. Data Privacy Framework and additionally on standard contractual clauses.

Further information can be found in Cloudflare's privacy policy.

9. Server and security logs

When you visit our online services, technically necessary information is processed. This may include in particular:

Browser type and version, operating system used, referrer URL, requested URL, time of the request, IP address as well as technical status and security information.

The processing serves in particular the technical provision, error analysis, defence against attacks and ensuring IT security.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of our systems.

This technical data is generally not combined with other data sets unless this is necessary to investigate misuse or security incidents.

10. Contacting us and contact form

If you contact us via the contact form, email, phone or in any other way, we process the information you provide in order to handle your enquiry.

This may include in particular name, company, email address, phone number, website address, request, system used, urgency and your message.

With the contact form, your details are transmitted in encrypted form to a function of our website at Cloudflare and forwarded from there directly to us by email via our Google Workspace account (see sections 7 and 11). They are not stored in a database of the website. You can optionally attach files to your enquiry (for example screenshots or log files); these are transmitted to us in the same way exclusively as an email attachment. Please do not attach any passwords or login details. You will receive an automatic confirmation email at the address provided.

If your enquiry relates to the conclusion or performance of a contract, the processing is based on Art. 6 (1) (b) GDPR. Other enquiries are processed on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in handling and answering the enquiry properly.

The data is deleted once the enquiry has been fully processed and there are no statutory retention obligations or other legitimate reasons for further storage.

11. Website check (voluntary security and GDPR check)

At www.nervenretter.com/webseiten-check/ we offer a free tool that allows you to have a web address you enter checked from the outside for publicly visible characteristics, such as security headers, encryption, embedded services and email protection entries in the DNS. To do this, a function at Cloudflare publicly retrieves the address entered and some of its subpages, just as a normal visitor would. Non-public areas of the checked site are not accessed.

To evaluate and further develop our service, we store the domain entered, the result in the form of key figures (for example score, number of notes, detected system), the time and the country code transmitted by the network. We do not store the user's IP address or any further personal data.

The legal basis is our legitimate interest in providing, evaluating and further developing the tool and in approaching potential prospects for our services (Art. 6 (1) (f) GDPR). The data is stored in a database at Cloudflare (Cloudflare D1, see section 8).

Please only enter addresses of websites you are authorised to check.

12. Email communication / Google Workspace

We use Google Workspace for our business email communication.

For users in the European Economic Area, the provider is generally:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

In the context of email communication, in particular sender and recipient addresses, communication content, times, attachments and other email metadata are processed.

Depending on the content of the communication, the processing is based on Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR.

Processing by Google companies or service providers outside the EEA cannot be completely ruled out. Google states that it uses, among other things, the EU-U.S. Data Privacy Framework and standard contractual clauses for such transfers.

13. Cookies and consent management (CookieYes)

Technically strictly necessary access to your device takes place without consent, provided the requirements of Section 25 (2) TDDDG are met. We only use cookies and technologies for analytics, advertising or marketing purposes if you have given your prior consent (Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG).

To manage your consent, we use CookieYes from CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. CookieYes stores your selection in a cookie in your browser and processes technically necessary data such as time, consent status and a pseudonymous consent ID in order to be able to prove consent. The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR. There is an adequacy decision by the EU Commission for the United Kingdom.

You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of the website.

14. External links and social networks

Our website contains links to external services, such as review portals like Google and ProvenExpert, partners or reference websites. This content is not embedded in our website; data is only transferred to the respective provider when you click on the link. The respective provider is responsible for the processing on the linked pages.

15. Google Tag Manager, Google Analytics and Google Ads

With your consent, we use Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool for managing website tags; it does not create usage profiles itself, but loads the other services. With Google Analytics we evaluate the use of our website, such as pages visited, length of stay, origin and interactions such as clicks on the phone number, email address or contact form. With Google Ads conversion tracking we measure whether visitors contact us after clicking on one of our ads.

In this context, IP address (shortened), device and browser information, time, pages visited, interactions and identifiers in cookies may be processed. The legal basis is your consent in accordance with Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. We use Google's consent mode: without consent, no analytics or advertising cookies are set.

A transfer to the USA cannot be ruled out. Google is certified under the EU-U.S. Data Privacy Framework and additionally uses standard contractual clauses.

16. Map services

We do not embed maps from Google Maps or other map services directly in our website. We merely link to our address; the map service is only accessed when you click on such a link, and its privacy policy then applies.

17. Nervenretter security archive

The Nervenretter security archive compiles publicly available information on vulnerabilities and security reports.

The technical information used in it comes in particular from publicly accessible sources such as NVD/NIST, CVE, CISA KEV, FIRST EPSS, GitHub Advisory Database and official publications of the respective manufacturers and projects.

The processing of this publicly available security data serves to provide an information and security service. No visitor-related profiles are created as a result.

Regardless of this, technical access data is processed in accordance with the provisions described above for Cloudflare and server logs.

18. Automated decision-making

Exclusively automated decision-making, including profiling within the meaning of Art. 22 GDPR, which produces legal effects concerning you or similarly significantly affects you, does not take place on our websites.

19. Changes to this privacy policy

We reserve the right to amend this privacy policy if the services used, the data processing or the legal requirements change.

The current version published on our websites applies.