Home / Privacy

Legal

Privacy policy

This website uses no cookies, no tracking and loads no third-party content. Here you can read in detail which data we process and when.

This is a translation for your convenience. Only the German version is legally binding.

1. Controller

The controller responsible for processing personal data on this website is:

Nexus Mechatronics & Data
Owner Seyed Mohamadreza Hashemi, sole proprietorship (Einzelunternehmen)
Im Zollhafen 18 – Kranhaus 1
50678 Cologne
Germany

Phone: +49 221 65058454
Email: info@nexus-mechatronics.de

No data protection officer has been appointed, as there is no legal obligation to do so. For any data protection questions, please contact us at the email address above.

2. Overview

Personal data is any information that can directly or indirectly identify a natural person, such as name, email address, phone number or IP address.

In short:

When you simply visit this website, only our hosting provider processes technically necessary access data (section 3).
We use no cookies, no analytics or marketing tools and no tracking.
Fonts and images are loaded from our own server. No content is loaded from Google, social networks or other third parties.
External sites such as LinkedIn are only contacted when you actively click the respective link. No appointment booking or form service is used.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Hosting and server logs

This website is operated by the following provider:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

Each time the website is accessed, the server automatically processes the following access data (server logs):

IP address of the requesting device
date and time of access
page or file requested
amount of data transferred and status code
previously visited page (referrer), if sent by the browser
browser type, browser version and operating system

This data is technically required to deliver the website, ensure its stability and security and fend off attacks. It is not combined with other data sources or analysed for marketing purposes.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and reliably.

Server logs are deleted after 14 days at the latest. Longer storage only occurs if individual data is needed to investigate a specific security incident, and only until it is resolved.

The server is located in a Hetzner data centre in Helsinki, Finland, within the European Union. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

4. No cookies, no tracking

This website does not store any information on your device and does not read any information from it. Neither cookies nor similar technologies (such as local storage, pixels or fingerprinting) are used. Consent under Section 25 TDDDG is therefore not required, and there is no cookie banner.

We use no services for audience measurement, web analytics or advertising, in particular not Google Analytics, Google Ads, Google Tag Manager or Meta Pixel.

Fonts (Geist, SIL Open Font License) and all images are stored on our own web server. No connection to Google Fonts or other content delivery networks is made when a page is loaded.

5. Encryption

This website is only accessible via an encrypted connection (TLS), indicated by “https://” in the address bar. Encryption prevents data from being read or altered by third parties during transmission.

6. Contact by email and phone

When you contact us by email or phone, including the fault hotline, we process the data you provide in order to handle your request. This may include in particular:

name, company, position
email address and phone number
content of your request, details of machines, plants or projects
documents, images or files you send
date and history of the communication

The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or its preparation. In all other cases the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in handling business enquiries.

Email via Google Workspace

For our business email we use Google Workspace from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Sender and recipient details, times, subject, content, attachments and technical connection data are processed. A data processing agreement under Art. 28 GDPR is in place with Google. For possible processing in the USA, see section 12.

Please do not send us highly sensitive data by email. Unencrypted emails cannot be fully protected against third-party access during transmission.

7. Contact via WhatsApp

This website contains no WhatsApp button and no WhatsApp integration. If you contact us via WhatsApp on your own initiative, the service is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp processes in particular your phone number, profile details and communication and connection data under its own responsibility. We process the content of your message solely to handle your request, on the basis of Art. 6(1)(b) or (f) GDPR.

Using WhatsApp is voluntary. You can always reach us by email or phone as well. Please do not send confidential access data or highly sensitive information via WhatsApp. More information: whatsapp.com/legal/privacy-policy-eea

8. Nexus platform and online orders

This website links to our own platform services, in particular the Nexus Industrial Ecosystem (ecosystem.nexus-mechatronics.de), the manufacturer area and product passports (app.nexus-mechatronics.de), the live demo (demo.nexus-mechatronics.de) and online ordering (commerce.nexus-mechatronics.de). Separate privacy notices apply to these services and are available there.

Where we operate Nexus Asset OS, Service OS or Manufacturing OS for customers and process personal data on their behalf, a data processing agreement under Art. 28 GDPR governs the details. This privacy policy does not replace customer-specific agreements.

9. Links to external websites

This website contains simple links to external services, for example LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) and our company profile on wlw (Visable GmbH, Hamburg). No data is transferred to these providers when you merely visit our website. Only when you click a link do you leave our website. The respective provider is responsible for data processing on the linked page.

10. B2B direct marketing and business development

We process publicly available business contact details of companies and their contact persons in order to inform companies about our products by post. This includes name, company, position or function and business postal address. The data comes from publicly available sources such as company websites, the commercial register and industry directories.

The legal basis is Art. 6(1)(f) GDPR in conjunction with recital 47 GDPR. Our legitimate interest lies in targeted outreach to companies whose activities our products may be relevant to. We do not send advertising by email, phone or messenger without your prior consent.

The data is deleted as soon as it is no longer needed for business development, at the latest two years after the last outreach without response. If you object, we only store the data needed to respect your objection (name, company, address) in a suppression list so that you are not contacted again.

Objection to direct marketing: You can object to the processing of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR). A short message to info@nexus-mechatronics.de is sufficient.

11. Recipients of personal data

We only pass on personal data where this is necessary to handle your request, perform a contract, operate our systems or comply with legal obligations. Recipients may include:

hosting and IT service providers (Hetzner Online GmbH)
email service (Google Ireland Limited)
tax advisers and accounting
payment service providers for orders
lawyers, authorities and courts where legally required

Service providers processing data on our behalf are bound by agreements under Art. 28 GDPR. We do not sell data or share it for third-party advertising.

12. Transfers to third countries

No data is transferred to countries outside the EU or EEA when you visit this website. A transfer to the USA is only possible if you use services described in sections 6 and 7:

Google Workspace (email): Google LLC is certified under the EU-U.S. Data Privacy Framework. The basis is the European Commission’s adequacy decision under Art. 45 GDPR, supplemented by standard contractual clauses.
WhatsApp: transfers to Meta Platforms, Inc. are the responsibility of WhatsApp Ireland Limited.

Despite these safeguards, a residual risk may remain, for example due to access by US authorities. If you want to avoid this, you can always reach us by phone or post.

13. Retention

Server logs: no more than 14 days (section 3).
Requests without a contract: deleted once fully handled, at the latest six months after the last contact, unless follow-up questions are expected.
Contract and billing data: for the term of the contract and thereafter in line with statutory retention periods (up to eight years for accounting records and up to six years for commercial correspondence, Section 147 AO, Section 257 HGB).
B2B direct marketing: see section 10.

Beyond this, we only store data for as long as necessary to establish, exercise or defend legal claims.

14. Your rights

Subject to the legal requirements, you have the following rights:

access to your stored data (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
objection (Art. 21 GDPR, see section 15)
withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal message to info@nexus-mechatronics.de is sufficient. We usually reply within one month.

15. Right to object under Art. 21 GDPR

Objection on grounds relating to your particular situation: Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

Objection to direct marketing: You can object to processing for direct marketing at any time without giving reasons. Your data will then no longer be used for direct marketing.

16. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes data protection law. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
www.ldi.nrw.de

You may also contact the supervisory authority in your place of residence, place of work or place of the alleged infringement.

17. Further information

Obligation to provide data

You are not obliged to provide us with personal data. Without certain details, however, we cannot handle requests, appointments, quotes or contracts.

No automated decision-making

There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Changes

We update this privacy policy when the legal situation, our services or our data processing change. The version published here applies.

Last updated: October 2026