Privacy Policy

1. Data Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

We take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Personal data means any data that can be used to personally identify you (e.g., name, email address, IP address). The processing of personal data is always carried out in accordance with the GDPR and applicable national data protection regulations.

This privacy policy applies exclusively to our website. It does not apply to third-party websites that we link to.

3. Server Log Files

When you visit our website, the hosting provider automatically collects and stores information in so-called server log files, which your browser automatically transmits. These include:

• Browser type and version
• Operating system used
• Referrer URL (the previously visited page)
• Host name of the accessing computer
• Time of the server request
• IP address (anonymised)

This data is not merged with other data sources. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and optimisation of the website).

The data is deleted as soon as it is no longer required for the purpose of its collection – typically after 7 days.

4. Contact Form and Email Enquiries

When you contact us via the contact form or by email, the data you provide (name, email address, message, and any additional information) is stored by us to process your enquiry and for possible follow-up questions.

We do not share this data without your consent. The legal basis is Art. 6(1)(b) GDPR (processing for the performance of pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in the efficient handling of enquiries).

The data you enter in the contact form will remain with us until you request its deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your enquiry has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

5. Cookies & Analytics

Our website uses technically necessary cookies and — with your consent — analytics services to improve our website. On your first visit, a cookie banner is displayed where you can choose between three options:

• Accept all — All analytics services are activated with full functionality (including cookies).
• Necessary only — Analytics services operate in cookieless mode. No tracking cookies are set; data collection is limited to anonymized usage statistics without persistent identifiers.
• Decline — No analytics services are loaded.

You can change your choice at any time via the "Cookie Settings" link in the page footer.

Technically Necessary Storage

• theme — Stores your preferred display mode (light/dark mode) in localStorage. Not a cookie in the technical sense.
• novaris_cookie_consent — Stores your cookie consent choice in localStorage.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the error-free and user-friendly provision of the website).

Google Analytics 4

We use Google Analytics 4 (Measurement ID: G-DJH7CGGES0), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyze the use of the website. Information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there.

• IP anonymization is enabled (anonymize_ip: true). Your IP address is truncated within the EU/EEA.
• Data collected: page views, scroll depth, time on page, CTA and button clicks, section visibility.

Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner) in conjunction with Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act; consent to accessing information on your device), since Google Analytics is only loaded after your choice in the cookie banner.

This may transfer data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer relies on this adequacy decision (Art. 45 GDPR).

Microsoft Clarity

We use Microsoft Clarity, a web analytics service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Clarity records anonymized usage data including:

• Session recordings (mouse movements, clicks, scroll behavior)
• Heatmaps (click distribution on the page)
• Scroll depth
• Dead clicks (clicks with no interaction)
• Rage clicks (repeated frustrated clicks)

When "Necessary only" is selected, Clarity operates in cookieless mode — no tracking cookies (_clck, _clsk) are set and no persistent identifiers are used. When "Accept all" is selected, Clarity cookies are set for improved session attribution.

Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in cookieless mode), in conjunction with Section 25(1) TDDDG (consent to accessing information on your device) for "Accept all", or Section 25(2) No. 2 TDDDG (technically necessary access) in cookieless mode.

This may transfer data to Microsoft Corporation in the USA. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer relies on this adequacy decision (Art. 45 GDPR).

More information: Microsoft Clarity Privacy Disclosure.

Appointment Booking (Google Calendar)

To schedule consultation appointments (e.g., on the "Forschungszulage Mittelstand" page), we link to Google Calendar's "Appointment Schedule" feature (domain calendar.app.google). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you book an appointment via this link, Google processes the data you enter (name, email address, selected time slot, and any additional information) to carry out the booking. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure at your request) or Art. 6(1)(a) GDPR for any additional voluntary information.

This may transfer data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer relies on this adequacy decision (Art. 45 GDPR).

We only receive the confirmation and contact details of your booked appointment, not access to your Google Calendar.

Whitepaper Request

If you request a document via our whitepaper form, we collect and process the following personal data:

• Name (required)
• Email address (required)
• Company (required)
• Phone number (optional)

Purpose: Sending the requested whitepaper by email and contacting you regarding our consulting services in the field of the research allowance.

Legal basis: Art. 6(1)(a) GDPR (consent). You grant your consent by activating the checkbox in the form. You may revoke this consent at any time with effect for the future.

Email delivery: Delivery is carried out via Google Workspace (Gmail) using the email address m.nodes@novaris-consulting.de. In doing so, your data is transferred to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

Retention period: Your data is stored for the duration of the business initiation and deleted at the latest after 24 months without further interaction, unless statutory retention obligations require otherwise.

Right of withdrawal: You can withdraw your consent at any time by email to info@novaris-consulting.de.

6. Hosting

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The personal data collected on this website is processed on Vercel's infrastructure. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access data, and other data generated via a website.

Static content is delivered via Vercel's global content delivery network; this project has no fixed EU server region configured, so Vercel's control-plane and support systems may also be located in the USA.

The host is used for the purpose of fulfilling our contract with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

Our host will only process your data to the extent necessary to fulfil its service obligations and will follow our instructions regarding this data. A Data Processing Addendum pursuant to Art. 28 GDPR is in place. Where personal data is transferred to the USA in this context, Vercel relies on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Your Rights as a Data Subject

You have the following rights with regard to your personal data:

You may request information about your stored data.

You may request correction of inaccurate data.

You may request deletion of your data.

You may request restriction of processing.

You may receive your data in a commonly used format.

You may object to data processing at any time.

To exercise your rights, please contact: datenschutz@novaris-consulting.de

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

8. Data Security

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and the lock icon in your browser bar.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties. We also take appropriate technical and organisational measures to protect your data against loss, destruction, unauthorised access, and unauthorised transmission.

9. Disclosure to Third Parties

We do not disclose your personal data to third parties for purposes other than those listed below. We only share your personal data with third parties if:

• You have given your express consent (Art. 6(1)(a) GDPR),
• Disclosure is necessary for the performance of a contract with you (Art. 6(1)(b) GDPR),
• There is a legal obligation to disclose (Art. 6(1)(c) GDPR),
• Disclosure is necessary for the protection of legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in not having your data disclosed (Art. 6(1)(f) GDPR).

10. Updates to this Privacy Policy

The content of this privacy policy was last amended in February 2026; the date in the page header records the most recent technical review. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be accessed and printed at any time on our website at novaris-consulting.com/en/datenschutz.