Privacy policy

1. Controller

The controller responsible for data processing on this website is:

thenex GmbHRobert-Bosch-Straße 4246397 BocholtGermanyPhone: +49 2871 2713 0E-mail: sales(at)thenex.comRepresented by: Henry-Johann Nientimp

2. Overview

Personal data is any data that can be used to identify you personally. This policy explains which data we collect when you use this website and what we use it for. We process your data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Unless a more specific storage period is stated in this policy, your personal data remains with us until the purpose for which it was processed no longer applies. If you make a justified request for erasure or withdraw your consent, your data is deleted unless we have other legally permissible reasons for storing it (for example retention periods under tax or commercial law); in that case it is deleted once those reasons no longer apply.

We pass personal data to external parties only where this is necessary to perform a contract, where we are legally obliged to do so (for example to tax authorities), where we have a legitimate interest under Art. 6 (1)(f) GDPR or where another legal basis permits it. Service providers that process personal data on our behalf (processors, such as the web agency and hosting providers named in this policy) receive it only on the basis of a data processing agreement.

3. Hosting and server log files

When you visit this website, the web server automatically records information that your browser transmits: the page requested, date and time, the HTTP status code, the referring page, browser type and version, operating system, and your IP address.

This data is required to deliver the website securely and to detect and defend against attacks. It is not merged with other data sources. The legal basis is Art. 6 (1)(f) GDPR — our legitimate interest in a secure, reliably functioning website. The website is maintained by our web agency, A/L Werbekonzept GbR, Alte Furt 28, 46499 Hamminkeln, Germany, and hosted on a server that it operates on our behalf at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Both process this data on our behalf.

The same server also handles the contact form and the optional reach measurement (section 4). Its access and error logs are rotated by size rather than after a fixed period: older files are deleted automatically once ten archived files per log have been reached, so entries can currently be kept for more than a year in logs that are written to rarely. The server's security logs (web application firewall and automatic blocking of attacks) are deleted after around eight weeks at the latest.

4. Reach measurement (only where enabled)

Our own data-minimising reach measurement is available for this website. Our web agency, A/L Werbekonzept GbR, operates it on our behalf on its server at IONOS SE. It is not a third-party service such as Google Analytics or the Meta Pixel; there is no advertising tracking, no cross-site tracking and no profiling. The following applies only where reach measurement is enabled for this website. As long as it is not enabled, no measurement script is loaded, your browser sends no requests to the analytics server and no processing for analytics purposes takes place. If it is disabled, the analytics server stops accepting reports immediately; the measurement script is removed with the next update of the website.

Where it is enabled, your browser sends a short report to the analytics server whenever a page is opened. The following is processed from it: the page opened (path without parameters or anchors) and the time it was opened; the previously visited page, if you came from another website (stored without parameters); campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), if the address contains any; device type, operating system and browser as broad categories, derived from the browser identification (user agent); the browser identification itself is not stored; your preferred language, from the language setting your browser sends with every request (the language code only, e.g. “de”); country, region and, where available, town, roughly derived from the IP address — using a database on the server itself, without passing the IP address to third parties.

If you send an enquiry through the contact form, the submission is also counted as an enquiry (conversion) in the statistics, together with the page it was sent from; the content of the form is not passed to the reach measurement.

Reach measurement sets no cookies, stores no information on your device and uses no persistent identifier. The measurement script does not actively access additional device characteristics such as screen or window size or comparable properties; no fingerprinting takes place. To be able to count visits, the server combines the IP address and browser identification with a random value generated anew each day to form a pseudonymous visitor value (hash) — pseudonymous, not anonymous data. The random value applies to one calendar day only and is deleted automatically once it is more than two days old (normally on the third following day); after that the visitor value can no longer be recreated, and a visit on another day is not recognised as the same visitor. Page views less than 30 minutes apart are grouped by the server into one visit with a random session identifier, which is not sent to your browser.

Reach measurement does not store your IP address. It is used only briefly in working memory: for the coarse location, for the pseudonymous visitor value and to limit the number of reports per sender within ten minutes. Like any web request, however, the report to the analytics server is recorded with the IP address in that web server's log files; the purposes and deletion rules described under section 3 apply.

Individual page views are stored for 90 days and then deleted automatically. After that only daily totals, with no link to individual visits, are kept for 760 days (around 25 months). The data is held in our web agency's database on the IONOS SE server; backup copies of this database are additionally stored on a separately rented, access-restricted backup server from the provider Hostinger and deleted after around three months at the latest.

The legal basis is our legitimate interest in evaluating the use of our website in a data-minimising way and improving what we offer (Art. 6 (1) (f) GDPR). You may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR); an informal message to the contact details above is enough.

5. Cookies and similar technologies

This website does not set cookies and does not use comparable technologies that store information in your browser or read it from your device. Reach measurement (section 4) does not store anything on your device either. No cookie banner is currently used.

6. Fonts

All fonts are stored on this website’s own server. No connection to third-party font services (such as Google Fonts) is established when you visit a page.

7. Contact form

If you send us an enquiry using the contact form, we process the details you enter (last name, first name, e-mail address and — if you provide them — company, postcode, town, phone number and your message) to handle your enquiry and any follow-up questions. The legal basis is your consent (Art. 6 (1)(a) GDPR) and, where your enquiry relates to a contract or pre-contractual measures, Art. 6 (1)(b) GDPR. You can withdraw your consent at any time with effect for the future by sending an informal e-mail to us.

The form is transmitted in encrypted form to the form server described in section 3, which forwards the enquiry to us by e-mail through the mail server of IONOS SE. Your e-mail address is set as the reply address so that we can answer you directly. The e-mail contains your details, the language of the form and the time it was sent, but not your IP address.

Where the enquiry inbox is enabled for this website, the form server additionally stores a copy of your enquiry in our web agency's database once the e-mail has been sent, so that it does not exist only in an e-mail mailbox. If reach measurement is also enabled, the landing page, the referring website and any campaign parameters of your current visit are attached to the enquiry. No IP address is stored with it. This copy is deleted automatically two years after it was received; backup copies of the database (Hostinger) after around three months at the latest. Where the enquiry inbox is not enabled, your enquiry is delivered by e-mail only and not stored in a database.

We keep your enquiry until it has been dealt with and no statutory retention obligations apply.

8. Spam protection

To protect the contact form against automated submissions, your browser solves a short computational task when you use the form, and the submission time and a hidden control field are checked. Your IP address is used briefly in the server's working memory to limit the number of submissions per sender within ten minutes. If a submission is rejected because of the hidden field or the computation, the IP address is noted together with the reason in the form server's application log, which is rotated weekly and deleted after around five weeks at the latest; accepted enquiries are noted there without an IP address. No cookies are set and no third-party CAPTCHA service is used. The legal basis is Art. 6 (1)(f) GDPR — our legitimate interest in protecting the form against misuse.

9. Contact by e-mail or phone

If you contact us by e-mail or phone, we process your details to handle your request (Art. 6 (1)(b) or (f) GDPR). The data is deleted once it is no longer required, subject to statutory retention periods.

10. Applications

If you send us an application (for example by e-mail or by post), we process the personal data it contains — such as contact details, application documents and notes from interviews — as far as this is necessary to decide whether to establish an employment relationship. The legal basis is § 26 BDSG (initiation of an employment relationship), Art. 6 (1)(b) GDPR (steps prior to entering into a contract) and, where you have given consent, Art. 6 (1)(a) GDPR; you can withdraw your consent at any time. Within our company, your data is passed only to the people involved in handling your application. If your application is successful, the data you submitted is stored on the basis of § 26 BDSG and Art. 6 (1)(b) GDPR for the purpose of carrying out the employment relationship.

If we cannot offer you a position, you decline an offer or you withdraw your application, we keep the data you submitted for up to six months after the application procedure has ended, on the basis of our legitimate interests (Art. 6 (1)(f) GDPR), in particular as evidence in the event of a legal dispute. The data is then deleted and paper documents are destroyed. If it is evident that the data will be needed beyond this period (for example because of an impending or pending legal dispute), it is deleted only once the purpose of further storage no longer applies. Longer storage may also take place if you have consented to it (Art. 6 (1)(a) GDPR) or if statutory retention obligations prevent deletion.

If we cannot offer you a position, we may be able to include you in our applicant pool so that we can contact you about suitable vacancies; all documents and details from your application are then transferred to the pool. This happens only with your express consent (Art. 6 (1)(a) GDPR), which is voluntary and has no bearing on the current application procedure. You can withdraw it at any time; the data is then irrevocably deleted from the applicant pool unless statutory retention obligations apply. Data in the applicant pool is irrevocably deleted at the latest two years after consent was given.

11. Your rights

You have the right to information about your stored personal data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1)(f) GDPR (Art. 21, see section 12). You can withdraw any consent at any time with effect for the future. To exercise your rights, contact us using the details above.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for our registered office: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

12. Right to object (Art. 21 GDPR)

Where processing is based on Art. 6 (1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on these provisions. The legal basis of each processing operation is stated in this privacy policy. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection under Art. 21 (1) GDPR).

Where your personal data is processed for direct marketing, you have the right to object at any time to its processing for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will then no longer be used for direct marketing (objection under Art. 21 (2) GDPR).

13. Encryption

This website uses TLS encryption for the transmission of all content, including enquiries sent to us. You can recognise an encrypted connection by “https://” in your browser’s address bar.

14. Objection to advertising e-mails

We hereby object to the use of the contact details published in our legal notice for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam e-mails.