Privacy notice

The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:

Otho Gabisonia, Brohrainstraße 5, 76131 Karlsruhe

Email: [email protected]

This notice covers the Nouvex website under this domain. Your account at GGS Network, which you sign in with here, is covered by the privacy notice of GGS Network.

The website presents the studio and its way of working. No contracts are concluded and no payments are processed through it, and it embeds no third-party content.

This website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland. The data centres are in Nuremberg and Falkenstein, Germany.

The provider processes the data solely on our behalf and on our instructions. A data processing agreement under Art. 28 GDPR is in place. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in providing the website securely and at a workable cost. The data never leave Germany.

With every request the web server logs technically necessary access data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to deliver the website reliably, to investigate faults and to repel attacks.

The logs are not combined with other data and are deleted after 30 days at the latest. What is recorded:

• IP address of the requesting device
• date and time of the request
• requested address, amount of data transferred and status message
• browser type, browser version and operating system

You can create an account here, with a name, an email address and a password. We store the name, the email address and whether it is confirmed, and the password as a hash only, never in plain text. When an account is created and whenever the password changes, we check it against known data breaches: our server hashes it and sends only the first five characters of that hash to the Have I Been Pwned service, never the password, the email address or your IP address.

Instead of a password you can use your GGS Network account. We send you to the sign-in page of GGS Network for that; you enter your password, passkey or second factor there, never on this website. GGS Network then passes to us your account identifier, your name, your email address and whether it is confirmed, the address of your profile picture if there is one, and the access keys for this handover. With these we create an account or join it to your existing one where both sides have confirmed the same address. We store the access keys encrypted and do not use them afterwards.

For every sign-in we store a session with your IP address and browser identifier. They serve the security of the account and end when you sign out, after seven days at the latest. The account itself remains until you ask for it to be deleted; an informal message to the address above is enough.

The legal basis is Art. 6(1)(b) GDPR: the processing is necessary to keep the account you create yourself and to carry out the sign-in you start yourself. For the breach check and the session details we rely on Art. 6(1)(f) GDPR, our interest in secure accounts.

We send emails to confirm your address and to reset a password. The recipient address and the content of the message are transmitted.

The messages are created through a queue in our own system and delivered through the mail server of Hetzner Online GmbH; the data processing agreement under Art. 28 GDPR covers this as well. The legal basis is Art. 6(1)(b) GDPR.

This website sets strictly necessary first-party cookies only (§ 25(2) no. 2 TDDDG). There is no audience measurement, and no profiles are built. These are set:

• NEXT_LOCALE: stores the language you chose, for the browser session.
• nouvex.state: protects the switch to GGS Network against forgery, five minutes at most.
• nouvex.session_token: keeps you signed in, until you sign out, seven days at most.

We pass on personal data only where this is necessary for the purposes described or where we are legally obliged to do so. Data are never sold. The recipients are:

• Hetzner Online GmbH for server operation and email delivery
• GGS Network for signing in through GGS, see above
• Have I Been Pwned for checking new passwords, only the first five characters of a hash, see above
• public authorities and courts, where we are legally obliged to disclose

In detail:

• access data: at most 30 days
• sessions with IP address and browser identifier: until you sign out, seven days at most
• account data: until the account is deleted

An informal message to the address or email address given above is enough to exercise your rights. We respond without undue delay and at the latest within one month. To protect your rights we may need to establish your identity before giving information.

You have the following rights in relation to us:

• access to the data we process about you, Art. 15 GDPR
• rectification of inaccurate data and completion of incomplete data, Art. 16 GDPR
• erasure, Art. 17 GDPR
• restriction of processing, Art. 18 GDPR
• data portability in a commonly used format, Art. 20 GDPR
• objection to processing based on legitimate interests, Art. 21 GDPR
• withdrawal of a consent given, with effect for the future, Art. 7(3) GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing.

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Without prejudice to any other remedy, Art. 77 GDPR gives you the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.

The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Postfach 10 29 32, 70025 Stuttgart. Visiting address: Heilbronner Straße 35, 70191 Stuttgart. Phone: 0711 615541-0, email: [email protected], web: https://www.baden-wuerttemberg.datenschutz.de

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. No assessment of personal aspects takes place and no usage profiles are built.

This website is delivered exclusively over an encrypted connection, recognisable from the address prefix and the padlock symbol in your browser. Content you send to us cannot be read by third parties in transit.

We update this notice whenever the processing described here changes or the legal situation requires it. The version available here at the time applies; the date of the last change is shown at the top of this page.