Privacy Policy
This is a translation for convenience. The German version is the legally binding text: Datenschutzerklärung.
1. Data protection at a glance
The following notes give you a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified.
- When you visit this website, technically necessary data is processed (server log files, a cookie storing your cookie choice), and – for reach measurement and advertising – services from Meta and Google are loaded that transmit data as soon as the page is opened (see section 7).
- External content (e.g. YouTube videos) is only loaded once you have given your consent, either through our cookie banner or through the relevant activation button.
- Data you send us (e.g. through contact forms) is used solely to deal with your enquiry.
2. Controller
The controller for the processing of data on this website is:
NK IT Service – Nikolaj Kinas
Rauentaler Str. 22/1, 76437 Rastatt
Phone: 07222 / 59 49 890
Email: support@nk-it.de
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
3. Hosting and server log files
External hosting
This website is hosted by an external service provider: Host Europe GmbH, Hansestraße 111, 51149 Köln, Germany (part of the GoDaddy group of companies). The servers are located in the European Union. The personal data collected on this website is processed on the servers of the host. This mainly concerns IP addresses, contact enquiries, meta and communication data, website access data and other data generated through a website.
Hosting takes place in order to fulfil our contract with potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR). We have concluded a data processing agreement (DPA) with our host in accordance with Art. 28 GDPR.
Server log files
The host automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address. This data is not combined with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR; our legitimate interest is the technically error-free presentation and the optimisation of the website as well as the investigation of misuse. The log files are deleted automatically after a short time.
4. Cookies and consent management (cookie banner)
This website uses as few cookies as possible. Cookies are small text files stored by your browser; they cause no damage and contain no viruses.
Technically necessary cookies: We store the choice you make in the cookie banner in our own cookie named nk_consent (storage period: 12 months). This cookie is required for the operation of the website and contains no data by which you can be personally identified. The legal basis is section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(f) GDPR (documenting and implementing your consent decision).
Services that require consent: Non-essential services – currently external media such as YouTube videos, the Meta pixel as well as Google Analytics 4 and Google Ads – are loaded only after you have given your consent through the cookie banner (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Google Analytics 4 belongs to the "Statistics" category, Google Ads, the Meta pixel and external media belong to the "Marketing & external media" category; details on the Google services are given in section 7. If further services are added, they will be named at this point. Not every connection to a third party is controlled by the cookie banner: the domain availability check (section 8) sends a query to Cloudflare as soon as you enter a name and start the check.
Withdrawal: You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of the website. The lawfulness of the processing carried out up to the withdrawal remains unaffected. The cookie banner is a solution developed for this website; no third-party providers are involved.
5. Contacting us, support tickets and repair orders
Contact forms
If you send us an enquiry through one of the contact forms on this website (including the quick contact window), we process the data you provide: first and last name, e-mail address, telephone number, your message and – depending on the form – details of your request. Your enquiry is stored as a ticket in our ticket system in the database of this website (see “Support enquiries and ticket system”). If the ticket system is unavailable, the enquiry reaches us by e-mail instead.
The processing serves to deal with your enquiry and any follow-up questions and is based on Art. 6(1)(b) GDPR (contract or pre-contractual measures) and on your consent (Art. 6(1)(a) GDPR), which you give by submitting the form. Your data remains with us until you ask us to delete it, withdraw your consent or the purpose of storage no longer applies. Mandatory statutory provisions – in particular commercial and tax retention periods of up to ten years for contract-related correspondence – remain unaffected.
Protection against misuse (form protection): To ward off automated and mass enquiries we limit the number of enquiries per hour. For every enquiry successfully sent through the contact form (including the quick contact window, the demo request, the data recovery submission and the job application form), the repair form and the appointment booking, and for every enquiry blocked by this limit, we log the time, the IP address, the e-mail address given, the form used and the outcome (passed or blocked). An enquiry through the contact or repair form that is blocked is additionally recorded in the log of failed form submissions (see below). The legal basis is our legitimate interest in preventing misuse and keeping our forms available (Art. 6(1)(f) GDPR). The log entries are deleted automatically after 30 days.
Log of failed form submissions: If submitting a contact form on this website (including the quick contact window, the demo request and the job application form), the repair form or the appointment booking (including rescheduling or cancelling, asking for a different time and agreeing to the costs of remote support) fails, for example because of a technical fault, an expired or incorrectly answered security question or missing required details, we store the attempt in a log in the database of this website. The same applies if your enquiry reaches us by e-mail but cannot be stored as a ticket because of a fault. If an enquiry does not reach our server, or reaches it incompletely, a script on this website sends the details separately to the log. We store the time, the form, the page, the language, the reason for the failure with technical details (e.g. missing fields, the answer entered to the security question, for the repair form the device and fault, for changes to an appointment the appointment number), your IP address and browser identifier as well as the contact details you entered (name, e-mail address, telephone number) and your message. If you successfully submit a form with the same e-mail address within 24 hours, we note this on the entry. The website notifies us of new entries by e-mail to our own mailbox – except for reports from your browser’s check of required fields and for the attempts classified as automated or suspicious described below. The e-mail contains the details of the entry without the IP address and browser identifier, with the message shortened; it is sent via Microsoft 365 (see “Support enquiries and ticket system”). This allows us to reach you so that your enquiry is not lost, and to fix errors. Attempts classified as automated are stored without contact details and message. Attempts without proof of an ordinary browser (for example without JavaScript or sent unusually fast) are stored with contact details but without notification so that we can check for false alarms. The legal basis for contacting you about your enquiry is Art. 6(1)(b) GDPR (enquiry prior to entering into a contract); otherwise – in particular for the IP address, browser identifier and error analysis – it is our legitimate interest in working forms and in preventing misuse (Art. 6(1)(f) GDPR). The entries are deleted automatically after 90 days. This automatic deletion does not cover the notification e-mails in our mailboxes; section 13 applies to them.
Log of sent e-mails: E-mails that this website sends or attempts to send when a contact form (including the quick contact window, the demo request, the data recovery submission and the job application form) or the repair form is submitted – for example the acknowledgement to you and the notification to us – are stored with form, recipient, subject, content, delivery status including any error message and source page in a log in the database of this website; access keys in links (for example to your ticket page or for confirming a demo request) are made unrecognisable. This serves to keep e-mail delivery traceable, to fix errors and to evidence that confirmation and acknowledgement e-mails were sent (Art. 6(1)(f) GDPR). The entries are deleted automatically after 365 days.
Free demo website (industry pages) and double opt-in
On our industry pages and on our AI page you can request a free demo website with no obligation. We store these enquiries as a separate record ("lead") in the database of this website in order to produce the demo draft and to contact you. We process the data you provide (first and last name, e-mail address, telephone number, project type, existing domain where applicable, your message) as well as the industry or source page the enquiry came from. The legal basis is Art. 6(1)(a) and (b) GDPR.
Confirming your e-mail address (double opt-in): After submitting the form you receive an e-mail containing a single-use confirmation link. We only create the demo website once you have confirmed. As evidence of your consent we store a record that the consent box was ticked, the time of the enquiry, the time of the confirmation and the IP address used at the time of the enquiry (Art. 6(1)(f) GDPR, evidence of valid consent). We retain the IP address as part of this evidence for as long as the enquiry itself is stored.
Storage period: If you do not confirm your e-mail address, we delete the enquiry automatically after 30 days at the latest; the e-mails sent in connection with it (confirmation e-mail to you, notification to us) remain in the log of sent e-mails for up to 365 days; the notification to us is also kept in our mailbox, section 13 applies to it. Confirmed enquiries are stored until they have been dealt with and beyond that until you request deletion or the purpose no longer applies; mandatory statutory retention periods remain unaffected.
Repair and mail-in enquiries
For enquiries sent through the repair form we additionally process the details you give about the device, manufacturer, model and fault as well as how you wish to hand the device over. The points set out for contact forms apply accordingly.
SEO and website check
For the free SEO check we process the domain you enter, your e-mail address and telephone number as well as details of your service and region in order to produce the analysis and send you the result (Art. 6(1)(b) GDPR). We carry out the analysis ourselves; the data is not passed on to third parties.
Contact by e-mail or telephone
If you contact us by e-mail or telephone, your enquiry including all personal data arising from it is stored and processed by us for the purpose of dealing with it (Art. 6(1)(b) and (f) GDPR).
Support enquiries and ticket system
We deal with enquiries sent through our forms and e-mails to our support mailbox in our own ticket system, which runs on this website – no external ticket provider involved. We store your name, e-mail address, telephone number (if given), subject, your messages, attached files and the history of how your request was handled. You receive an acknowledgement with a personal link to your ticket page; the link is valid for 180 days from the last activity in the ticket. We receive and send e-mails to and from our support mailbox via Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The legal basis is dealing with your enquiry and performing the contract or pre-contractual measures (Art. 6(1)(b) GDPR) as well as our legitimate interest in handling requests in an orderly and traceable way (Art. 6(1)(f) GDPR).
AI-assisted reply drafts: For drafts of our replies we may use the AI service of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. In that case we transmit the ticket number, subject, status, category, the time the ticket was opened and last updated, your name, the number of your other tickets with us, the messages visible in the ticket – yours, our replies and, where we have merged enquiries from several people into one ticket, their messages too – as well as up to three images (JPG, PNG) and one PDF file from it and, where applicable, a staff member’s notes for the reply. If automatic drafting is switched on, this as a rule happens automatically in the background whenever you send us a new message. We do not transmit your e-mail address separately. If it or other contact details such as your telephone number or address appear in the text of a message – for example in enquiries sent through the repair form or in an e-mail signature – they are transmitted as well. In the text of the messages, passwords given in the form “password: …” as well as insurance and contract numbers are made unrecognisable beforehand; complete detection is not possible. Images and PDF files are transmitted unchanged – anything they show, for example an insurance number in a photo, reaches the service unredacted. Under its contractual terms, OpenAI does not use the data to train its models; this may involve a transfer to the USA, which is safeguarded by EU standard contractual clauses. A member of staff checks every draft before a reply is sent to you; no automated decision takes place. The legal basis is our legitimate interest in dealing with your enquiry quickly and carefully (Art. 6(1)(f) GDPR).
Storage period: We delete tickets together with their history and attachments automatically 24 months after the last activity. Your name and e-mail address remain in our customer file so that we can match later enquiries. Incoming e-mails and our replies sent by e-mail are also kept in our mailbox at Microsoft 365; these copies are not covered by the automatic deletion, section 13 applies to them. We put sender addresses that send spam on a block list. Of the submissions rejected by the support form (suspected automated enquiries) we keep only the latest 30, with name, e-mail address and a text excerpt, in order to detect false alarms (Art. 6(1)(f) GDPR).
You can reach us via WhatsApp. The button on our website is a plain link; only when you click it and use WhatsApp does WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (part of the Meta group of companies) process your data under its own privacy terms; this may involve a transfer to the USA. We process the communication conducted via WhatsApp in order to deal with your enquiry (Art. 6(1)(b) GDPR). Details: WhatsApp privacy policy.
Online appointment booking
You book appointments directly through the booking system of this website – no third-party provider involved. We process the data you provide (name, e-mail address, telephone number, subject, chosen appointment) and, as evidence of the booking, the time of your consent and your IP address. The data is stored in the database of the website and processed solely to arrange and manage the appointment (Art. 6(1)(b) GDPR); you receive confirmation, reminder and change links by e-mail. You can reschedule or cancel the appointment yourself via the link in your confirmation e-mail. Your data remains with us until you request deletion or the purpose of storage no longer applies; you can exercise your data subject rights via the WordPress privacy tools or informally by e-mail.
Remote support requested online: If you book remote support online, the appointment only becomes binding once you expressly agree to the costs via the link in our e-mail. For this purpose we ask for your billing address. As evidence of your agreement we store the time, the wording and version of the consent text, the pricing rule and – if you agree via the website – your IP address (Art. 6(1)(b) and (f) GDPR). If you have not agreed by about half of the deadline, you receive a single reminder by e-mail; it relates only to your request and contains no advertising (Art. 6(1)(b) GDPR). If you do not agree by the end of the deadline, the request lapses and we inform you by e-mail.
Remote support (TeamViewer)
For remote support sessions we use TeamViewer from TeamViewer Germany GmbH, Bahnhofsplatz 2, 73033 Göppingen, Germany. The button on our website is a link to download the module; a session is only established once you start the module and give us the connection details. The processing serves to provide the support service you have commissioned (Art. 6(1)(b) GDPR). Details: TeamViewer privacy policy.
Repair and service orders
If you give us a device for testing, repair or maintenance, we process the data needed to accept, carry out, document and invoice the order: name, company and VAT ID where applicable, address, e-mail address, telephone number, details of the device (such as model, serial number, accessories, existing damage and fault description), details of any device insurance, photos of the device, your signature on drop-off and collection, cost estimates, invoices and the history of the order. We record the order ourselves, or you record it at the drop-off terminal in our shop. The data is kept in the database and in a protected file storage area of this website. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for invoices and accounting records, also the statutory retention obligation (Art. 6(1)(c) GDPR).
Device code or PIN: If you give us a device code or PIN, we store it encrypted and log every time it is viewed. As soon as the device has been collected or shipped or the order has been cancelled or closed, the code is deleted automatically.
Personal order link: With a personal link you can follow the progress of your order, approve cost estimates and ask questions. The link is valid while the order is open and usually for 30 more days afterwards. When you first open it, we ask for the postcode of your order address. Once you have entered it correctly, we set the technically necessary cookie “nka_plz_…” for this one order (lifetime 30 days) so that you do not have to enter the postcode again each time (Section 25(2) no. 2 TDDDG). To protect against postcodes being guessed, we store every attempt with time, result and IP address and delete these entries after 90 days (Art. 6(1)(f) GDPR). No analytics or advertising services run on the order page.
Evidence and questions: If you approve or reject a cost estimate via the link, we store the time, the decision and your IP address as evidence. We also store the other entries in the order history, such as questions, with time and IP address (Art. 6(1)(b) and (f) GDPR). Questions are additionally created as a ticket in our ticket system (see “Support enquiries and ticket system”).
Notifications and collection: We keep you informed of progress by e-mail, for example with the drop-off confirmation including the order document, status updates, cost estimates, the completion notice and the invoice. For collection you receive a four-digit collection code. At the drop-off terminal you can instead identify yourself with your e-mail address or telephone number, postcode and house number; we only compare these entries with the order and do not store them. After five failed attempts we block collection at the terminal and note the block in the order history.
Request for a review: After an order has been completed we may ask you by e-mail to review us on Google (Art. 6(1)(f) GDPR). You submit the review directly on Google; we do not transmit any data to Google for this. You can object to this use of your e-mail address at any time, for example with a short e-mail to us.
Storage period: Unless a shorter period is stated above, section 13 applies.
6. YouTube videos (two-click solution)
On individual pages (currently on the "Drone photography" page) we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the enhanced privacy mode (youtube-nocookie.com) and load the videos only after you have given your consent – either through the "Marketing & external media" category in the cookie banner or through the "Activate video" button on the video itself. Until then only a locally stored preview image is displayed and no data is transmitted to YouTube.
On activation your browser establishes a connection to the servers of YouTube; this transmits your IP address and device information among other data, and YouTube may set its own cookies or comparable technologies. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG); you can withdraw it at any time through the "Cookie settings" in the footer. Details: Google privacy policy.
7. Reach measurement and advertising (Meta Pixel, Google Ads, Google Analytics)
Meta Pixel: This website uses the "Meta Pixel" from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We use it to measure the success of our advertising on Facebook and Instagram and to analyse which actions visitors carry out on our website (e.g. submitting a form). The pixel is loaded as soon as the website is opened; this transmits data to Meta, including to the USA.
Google Ads and Google Analytics 4: We use conversion tracking from Google Ads as well as Google Analytics 4, both services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use them to measure the success of our adverts and to analyse how the website is used (e.g. pages viewed, forms submitted). Both services are loaded only after you have given your consent in the cookie banner: Google Analytics 4 with the "Statistics" category, Google Ads with the "Marketing & external media" category. Only then is data transmitted to Google, including a transfer to the USA. Google LLC is certified under the EU-US Data Privacy Framework.
The legal basis is our legitimate interest in marketing our services effectively and economically (Art. 6(1)(f) GDPR). You can object to this processing at any time on grounds relating to your particular situation (see section 12) and limit the tracking through the advertising settings of Meta (facebook.com/adpreferences) and Google (adssettings.google.com) as well as through the settings of your browser. Further information: Meta privacy policy and Google privacy policy.
8. Domain availability check (Cloudflare DNS)
On our pages about domains and web hosting you can check whether a domain name is still available. The query only starts once you enter a name and trigger the check; merely opening the page does not establish any connection to Cloudflare. For the check your browser queries the public DNS service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, at cloudflare-dns.com (DNS over HTTPS). No cookies are set for this, and no information is stored on or read from your device.
What is transmitted is the domain name you enter – readable by Cloudflare in plain text – together with the connection data your browser has to send for technical reasons, in particular your IP address. If you do not enter an extension, we check eight common extensions in one go and send eight separate queries for that purpose; if you enter an extension that is not among those eight, there are nine. The result is displayed in your browser only; we store neither the query nor the result.
The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request) and our legitimate interest in providing quick and reliable information (Art. 6(1)(f) GDPR). Cloudflare, Inc. is based in the USA; the query therefore transfers the data named above to the USA. The transfer is necessary in order to carry out the check you have requested (Art. 49(1)(b) GDPR). If you wish to avoid this, do not use the check and tell us the name you want through the contact form or by telephone – we will then check it for you. Details of the processing by Cloudflare: Cloudflare privacy policy and privacy notice for the public DNS resolver.
9. Fonts, maps and external links
Local fonts: This website uses web fonts that are stored locally on our own server. No connection to servers operated by Google (Google Fonts) or other third-party providers takes place.
Directions: The address in the header links to Google Maps. This is a plain link without an embedded map; data is only processed once you click the link and open the Google Maps page.
Social media and portal links: Links to our profiles (e.g. Facebook, X, Xing) and to our customer portal are plain links without embedded content. Once you click them, the privacy terms of the respective provider apply.
10. Job applications
If you apply to us for a job, we process your application data in order to carry out the application procedure (Art. 6(1)(b) GDPR, section 26 BDSG, the German Federal Data Protection Act). Applications sent through the application form on this website or by e-mail to our support mailbox are stored as a ticket in our ticket system (see section 5, “Support enquiries and ticket system”) and are deleted automatically together with their history and attachments 24 months after the last activity. Your name and e-mail address remain in our customer file even after that (see “Storage period” in section 5). For applications by e-mail, the original e-mail including attachments, and for applications through the form, our notification containing your contact details and the beginning of your message, also remain stored in our mailbox at Microsoft 365; these copies are not covered by the automatic deletion, section 13 applies to them. AI-assisted reply drafts may also be used for applications (see section 5). If you send us application documents by other means (to another e-mail address or by post) and no appointment is made, we delete them no later than six months after the procedure has ended, unless statutory retention obligations apply or you have expressly consented to longer storage (talent pool).
11. SSL and TLS encryption
For security reasons and to protect the transmission of confidential content (e.g. enquiries sent through forms), this website uses SSL or TLS encryption. You can recognise an encrypted connection by "https://" and the padlock symbol in the address bar of your browser. When encryption is active, data you send to us cannot be read by third parties.
12. Your rights
You have the following rights in respect of your personal data:
- Access to the data stored about you, its origin, its recipients and the purpose of the processing (Art. 15 GDPR),
- Rectification of inaccurate data (Art. 16 GDPR),
- Erasure of your data, provided that no statutory retention obligations prevent it (Art. 17 GDPR),
- Restriction of processing (Art. 18 GDPR),
- Data portability: receipt of the data we process by automated means on the basis of your consent or in performance of a contract, in a commonly used, machine-readable format (Art. 20 GDPR),
- Withdrawal of a consent you have given, with effect for the future (Art. 7(3) GDPR) – an informal message by e-mail is sufficient; for cookies and external media through the "Cookie settings" link in the footer.
Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Right to lodge a complaint: In the event of breaches of data protection law you can lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.
13. Storage period, obligation to provide data, automated decisions
Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of the processing no longer applies, you request deletion or you withdraw a consent. Statutory retention obligations (in particular six or ten years under German commercial and tax law) remain unaffected.
Providing your data is required neither by law nor by contract; without the necessary details (e.g. contact data in a form), however, we cannot deal with your enquiry.
Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.
14. Validity and amendment of this privacy policy
We amend this privacy policy as soon as the legal situation or the services used on this website change. The version published here is the one that applies.
Last updated: October 2026