Privacy Policy Website

Below we inform you about the processing of your personal data on our website and about the rights to which you are entitled in this context.

This privacy notice applies to the processing of your personal data by the controller named in the “Controller” section. For individual processing operations – for example, in the context of processing personal data on behalf of our customers – different controllerships may apply. Where relevant, we will expressly point out such differing controllerships at the respective point.

 

1 Controller

The controller within the meaning of Regulation (EU) 2016/679 - General Data Protection Regulation (“GDPR”) for the processing of your data (the “Controller”), unless stated otherwise at the respective points in this privacy notice, is:

nooa GmbH

Rheinkaistraße 1

68159 Mannheim

Germany

(hereinafter also referred to as nooa).

For any questions concerning data protection or to exercise your data subject rights, you can contact the following email address at any time: privacy@nooa.app

2 Data Protection Officer

We have appointed the following Data Protection Officer:

Kertos GmbH

Brienner Straße 41

80333 München

dataprivacy(at)kertos.io

3 Legal Bases

Depending on the nature and purpose of the processing, the following legal bases of the GDPR may apply:

Art. 6(1)(a) GDPR	Under this provision, the processing of personal data is permissible if you have given your explicit consent to it.
Art. 6(1)(b) GDPR	Under this provision, the processing of personal data is lawful if it is necessary for the performance of a contract to which you are a party or in order to take steps prior to entering into a contract.
Art. 6(1)(c) GDPR	Under this provision, the processing of personal data is lawful if it is necessary for compliance with a legal obligation to which we are subject.
Art. 6(1)(f) GDPR	Under this provision, the processing of personal data is lawful if it is necessary for the purposes of our legitimate interests or those of a third party, except where your interests or fundamental rights and freedoms which require the protection of personal data override those interests.

4 Web Hosting and Provision of the Website

Purpose of the Processing

We make our website available and ensure its technically flawless and secure operation. When you access our website, our servers automatically collect and store information in server log files that your browser transmits. We use HubSpot for hosting and content management.

In this context, we process your browser type and version, the operating system used, the referrer URL, the host name of the accessing computer, the date and time of the server request, and your IP address.

Legal Basis of the Processing

Art. 6(1)(f) GDPR

Our legitimate interest lies in the technically flawless presentation and the secure operation of our website.

5 Contacting Us

Purpose of the Processing

You can contact us by email or via the forms provided on our website (e.g. contact form, form for further information, quote request). We process the data transmitted in this context in order to answer and handle your enquiry. We use HubSpot as a customer relationship management system to manage these enquiries.

In this context, we process your email address, your name, where applicable your organisation and the number of employees, as well as the content of your message.

Legal Basis of the Processing

Art. 6(1)(b) GDPR, insofar as the contact is aimed at the conclusion or performance of a contract.

Art. 6(1)(f) GDPR.

Our legitimate interest lies in answering and handling your enquiries.

6 Booking Appointments for Product Demonstrations and Consultations

Purpose of the Processing

On our website, you can book appointments for product demonstrations or welcome consultations. We use HubSpot Meetings for the booking, and we use Google Calendar from Google Workspace and Zoom to manage and conduct the appointments.

In this context, we process your preferred appointment time, your first and last name, and your email address.

Legal Basis of the Processing

Art. 6(1)(b) GDPR, insofar as the appointment booking is aimed at the conclusion or performance of a contract.

Art. 6(1)(f) GDPR.

Our legitimate interest lies in the efficient organisation and conduct of appointments with prospects and customers.

7 Registration for and Delivery of Webinars and Product Demos

Purpose of the Processing

On our website, you can register for webinars and product demos. We use Zoom to deliver them and HubSpot as well as Google Calendar from Google Workspace for registration and administration.

In this context, we process your email address, your name, your job title and your company, as well as registration, profile and device information in the course of delivery.

Legal Basis of the Processing

Art. 6(1)(b) GDPR.

8 Provision of Downloads

Purpose of the Processing

On our website, you can request free documents such as whitepapers, checklists or templates. We process your data in order to deliver the requested documents to you. We use HubSpot for this purpose.

In this context, we process your email address, your name, your job title and your company.

Legal Basis of the Processing

Art. 6(1)(b) GDPR.

9 Processing of End-User Data within the nooa Platform

This section is intended for end users of our SaaS products that our business customers use – i.e. typically employees or customers of our business customers.

If you use the nooa platform because your employer or a company with which you have a business relationship uses our products and services, our business customer acts as the controller under data protection law for the processing of your data. In this context, nooa GmbH does not process your data as a controller, but exclusively as a processor pursuant to Art. 28 GDPR, i.e. on the instructions of and on behalf of this business customer.

We process personal data in the context of the provision and operation of the nooa platform exclusively on the instructions of our business customers and in order to fulfil our contractual performance obligations towards them. The nooa platform is a SaaS solution for communication, collaboration and organisation in the healthcare and care sector, through which our business customers provide their authorised users with functions such as messages, pinboards, tasks and the sharing of content.

Depending on the configuration by our customer, we process in particular master and contact data (e.g. name, username, role, organisation, email address), usage and connection data (e.g. IP address, device and browser information, log information), as well as content data entered into the platform (e.g. messages, posts, comments, tasks and files).

Complete information about which data is processed in this context, how and on what legal basis, can be obtained from the respective controller – i.e. the company that uses the nooa platform. For information and to exercise your data subject rights, please contact this company directly.

10 Improvement and Further Development of Our Products

Purpose of the Processing

To continuously improve and further develop our products and services, we analyse usage data of our end users. In doing so, we analyse how functions are used, where users encounter problems and where there is a need for optimisation. In this context, we process in particular pseudonymised usage and interaction data (e.g. functions accessed, click paths, error messages, session duration). No analysis is carried out at the level of individual identified persons.

Legal Basis of the Processing

Art. 6(1)(f) GDPR.

Our legitimate interest lies in continuously improving our products and services, detecting and remedying errors, and developing new functions in line with needs. The processing is limited to pseudonymised usage data. The identification of individual persons is neither the aim nor the result of the analysis.

11 Marketing and Direct Advertising

We process your personal data in order to provide you with information about our products, offers and services, and we carry out measures for advertising purposes, for customer retention and for the optimisation of our offers. This takes place, for example, in the form of newsletters and letters. In addition, we carry out market and opinion research measures, for example in the form of surveys. The legal basis for this is our legitimate interest in improving our products and services pursuant to Art. 6(1)(f) GDPR. Insofar as we obtain your separate consent for such measures, your consent pursuant to Art. 6(1)(a) GDPR is the legal basis.

Insofar as we contact you for advertising purposes without a business relationship already existing between us – in particular when sending newsletters or when addressing you for advertising purposes by email – this is done exclusively on the basis of your prior explicit consent pursuant to Art. 6(1)(a) GDPR. The same applies to advertising telephone calls to consumers, which we only carry out with your prior explicit consent. Advertising calls to businesses are only made where consent may be presumed. You can withdraw your consent at any time with effect for the future, for example by the means indicated when consent was given or by an informal message to us. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

If, on the other hand, you have already purchased goods or services from us, we use the email address provided in this context to send you advertising for our own, similar products. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. In doing so, we rely on the exception applicable to existing customers under Art. 13(2) of Directive 2002/58/EC (the ePrivacy Directive) in conjunction with the respective national implementing laws – in Germany, this is Section 7(3) of the Act against Unfair Competition (“UWG”). This use only takes place for as long as you have not objected to it. We inform you of your right to object both when your data is collected and with each further advertising communication. For the objection, you incur no costs other than the transmission costs at the base rates.

12 Cookies and Similar Technologies

We use cookies and similar technologies (hereinafter “Cookies") on our website. Cookies are small text files that are stored on your device by your browser. Cookies do not run programs and do not install any malware. Comparable technologies include web storage (local/session storage), fingerprinting, tags and pixels. If cookies or similar technologies are blocked, the functionality of our website may be limited or certain functions of the website may not be fully available. When you first access our website, you are informed in detail about the use of such technologies.

12.1 Necessary Cookies

Purpose of the Processing

The following cookies are necessary for the technically flawless provision and secure operation of our website.

Cookie	Service	Duration	Description
__cf_bm	HubSpot Forms (Cloudflare)	30 min.	Bot management to secure form and interaction functions.
__cf_bm	HubSpot CMS (Cloudflare)	30 min.	Bot management in the context of website hosting.
__hs_cookie_cat_pref	HubSpot	5 months 27 days	Stores your cookie consent preferences.
hs_ab_test	HubSpot	Session	Enables the consistent delivery of page variants.
__hssrc	HubSpot	Session	Detects whether the user has restarted their browser session.
cartographer-flushed	HubSpot	Session	Technically necessary status information for page delivery.
rhumb_transition_history	HubSpot	Session	Technically necessary status information for page navigation.
__hub_http_flushed	HubSpot	Session	Technically necessary status information for page delivery.
hubspot-modern-theme	HubSpot	Unlimited	Stores theme/display settings of the website.
_cfuvid	HubSpot (Cloudflare)	Session	Technically necessary Cloudflare status information.

Legal Basis of the Processing

Art. 6(1)(f) GDPR in conjunction with Section 25(2) of the Telecommunications Digital Services Data Protection Act (“TDDDG”).

Our legitimate interest, or our overriding interest as the justification ground, lies in the technical provision and secure operation of our website.

12.2 Optional Cookies

Purpose of the Processing

The optional cookies described below are not necessary for the operation of the website. These are, for example, marketing, performance and analytics cookies that help us understand how visitors use the website. In particular, they provide us with information on usage behaviour and thereby support us both in optimising the user experience and in measuring the success of our marketing measures.

When you first access our website, you are informed in detail about the use of such technologies and have the option to decline the use of services that are not strictly necessary for using the website. You can access the cookie settings at any time via the footer of the website in order to adjust your preferences with effect for the future.

Cookie	Service	Duration	Description
_gcl_au	Google Ads Conversion Tracking	2 months 29 days	Conversion tracking for programmatic advertising.
_gcl_ls	Google Ads	Unlimited	Supports conversion tracking for advertising.
_fbp	Meta Pixel	2 months 29 days	Reach measurement and delivery of advertising via Meta.
lastExternalReferrer	Meta Pixel	Unlimited	Stores the referrer source for advertising purposes.
lastExternalReferrerTime	Meta Pixel	Unlimited	Stores the timestamp of the referrer source for advertising purposes.
_ga	Google Analytics	1 year 1 month	Analysis of usage behaviour (recognition of visitors).
_ga_99F3Z2K9LL	Google Analytics	1 year 1 month	Analysis of usage behaviour (property-specific recognition).
_gat_devteam	Google Universal Analytics	1 min.	Throttling of the request rate for analytics.
gaCookie1	Google Universal Analytics	1 year 1 month	Analysis of usage behaviour.
gaCookie1_gid	Google Universal Analytics	1 day	Distinguishing visitors for analytics.
_hjSessionUser_4935524	Hotjar	11 months 31 days	Recognition of visitors for the analysis of usage behaviour.
hjActiveViewportIds	Hotjar	Unlimited	Stores information for the analysis of usage behaviour.
hjViewportId	Hotjar	Session	Stores information for the analysis of usage behaviour.
__hstc	HubSpot Analytics	5 months 27 days	Analysis of usage behaviour (main tracking cookie).
__hssc	HubSpot Analytics	30 min.	Analysis of usage behaviour (session counting).
hubspotutk	HubSpot Analytics	5 months 27 days	Recognition of visitors for analytics.
__cf_bm	HubSpot Analytics (Cloudflare)	30 min.	Bot management in the context of the analytics services.
__cf_bm	HubSpot Livechat	30 min.	Bot management in the context of the live chat.
HUBLYTICS_EVENTS_53	HubSpot	Unlimited	Stores event data for the embedding of external content.
__hmpl	HubSpot	Unlimited	Stores data for the embedding of external content.
__cf_bm	X / Twitter	30 min.	Bot management in the context of embedded social media content.
_ga	Google Analytics (Outgrow)	1 year 1 month	Analysis of usage behaviour via embedded Outgrow content.
_ga_99F3Z2K9LL	Google Analytics (Outgrow)	1 year 1 month	Analysis of usage behaviour via embedded Outgrow content.
_gat_devteam	Google Universal Analytics (Outgrow)	1 min.	Throttling of the request rate via embedded Outgrow content.
gaCookie1	Google Universal Analytics (Outgrow)	1 year 1 month	Analysis of usage behaviour via embedded Outgrow content.
gaCookie1_gid	Google Universal Analytics (Outgrow)	1 day	Distinguishing visitors via embedded Outgrow content.
_OG_GDPR_COOKIE_	Outgrow	Session	Stores consent information in the context of embedded Outgrow content.

Legal Basis of the Processing

Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

13 Automated Decision-Making

In the aforementioned data processing operations, we do not use automated decision-making within the meaning of Art. 22 GDPR.

14 Artificial Intelligence ("AI")

As part of the processing of personal data described in this privacy notice, we may use artificial intelligence. This may take place in particular for the following purposes:

• process support, optimisation and automation,
• support of IT security, e.g. through the identification of security-relevant anomalies,
• support in the creation, revision, analysis and review of content, as well as in accessing, preparing and using company knowledge,
• data analysis, evaluation and recognition of patterns, trends and correlations, as well as the creation of forecasts and decision support.

The use of artificial intelligence takes place in accordance with the legal requirements of the GDPR as well as Regulation (EU) 2024/1689 - the Regulation on Artificial Intelligence (the ″AI Act″) and serves exclusively supporting, preparatory or monitoring purposes. Automated decision-making or profiling with legal effect or similarly significant impact within the meaning of Art. 22 GDPR does not take place. At no time is personal data used to train AI‑models.

15 Recipients of Your Data

As a rule, a transfer of the personal data we have collected only takes place if you have given your explicit consent pursuant to Art. 6(1)(a) GDPR, if the disclosure is necessary pursuant to Art. 6(1)(f) GDPR to safeguard legitimate interests or for the establishment, exercise or defence of legal claims and there is no reason to assume that your overriding interests worthy of protection prevail, if we are legally obliged to do so (Art. 6(1)(c) GDPR), or if the disclosure is legally permissible and necessary for the performance of a contract or for the implementation of pre-contractual measures (Art. 6(1)(b) GDPR).

The following lists the recipients to whom we transfer personal data, as well as the respective purpose of their use:

HubSpot Germany GmbH

Am Postbahnhof 17

10243 Berlin

Deutschland

CRM, content management, web hosting, forms, appointment booking, webinar registration and provision of downloads.

Google Ireland Limited

Gordon House, Barrow Street

Dublin 4

Ireland

Management and conduct of booked appointments via Google Calendar and Google Meet.

Zoom Video Communications, Inc.

55 Almaden Blvd., Suite 600

San Jose, CA 95113

USA

Delivery of webinars and product demonstrations.

Outgrow, Inc.

2035 Sunset Lake Road, Suite B-2

Newark, DE 19702

USA

Provision of interactive content on the website (e.g. calculators, quizzes). Cookies are set and analytics services (including Google Analytics) are loaded via the embedded service.

In addition, we may, where necessary, transfer your data to further recipients such as authorities, public offices and similar recipients. This concerns, for example, tax authorities, public prosecutors' offices and courts, as well as auditors.

Insofar as the described data transfers constitute processing on behalf of a controller within the meaning of Art. 28 GDPR, we ensure that such processing takes place exclusively on the basis of data processing agreements that meet the legal requirements of the GDPR. These oblige the respective processor in particular to process personal data exclusively in accordance with our instructions, to ensure a level of data protection appropriate to the risk, and to comply with data protection obligations – in particular with regard to supporting the fulfilment of data subject rights.

If, on the other hand, certain data transfers take place within the framework of joint controllership pursuant to Art. 26 GDPR, this is done on the basis of a joint controllership agreement. This agreement clearly defines in particular the respective roles and responsibilities with regard to compliance with data protection requirements – for example, which controller is responsible for which obligations in connection with the handling of data subject rights or the fulfilment of information obligations. We will make the essential contents of such agreements available to you on request.

16 Data Transfers to Third Countries

Some of the recipients of your personal data named in the previous section are located in so-called third countries, in which the level of data protection is not comparable to that in the EU. Third countries are all countries outside the European Economic Area. The European Economic Area comprises all countries of the European Union as well as the countries of the so-called European Free Trade Association. These are Norway, Iceland and Liechtenstein.

Data transfers to such countries may take place, for example, when we use service providers located in a third country. Transfers of personal data to third countries take place on the basis of an adequacy decision of the European Commission. If there is no adequacy decision of the European Commission for the respective third country, the transfer takes place on the basis of appropriate safeguards within the meaning of Art. 46(2) GDPR. Copies of these safeguards can be requested from the controller.

In addition, some recipients of your personal data based in the USA may be certified under the EU-U.S. Data Privacy Framework (“DPF”). For such recipients, a limited adequacy decision exists for certain categories of data. To the extent of the recipient's valid DPF certification, the transfer of personal data takes place on the basis of this adequacy decision.

17 Storage Period

We process personal data only for as long as is necessary for the respective processing purpose. As soon as the purpose ceases to apply and no statutory retention obligation or any other reason stated below precludes erasure, the data is deleted or anonymised.

The specific storage period is determined by the following criteria. Where several criteria apply, the longest period is decisive in each case. After it expires, the data is routinely deleted.

• Purpose Limitation

For as long as we need the data to achieve the respective processing purpose – for example, to provide our services, to communicate with you or to perform a contract – we store it for the duration of that purpose.

• Consent

Data that we process on the basis of your consent is stored until you withdraw your consent, but at the longest until the purpose of the processing ceases to apply.

• Contractual Relationship

Data that we process within the framework of a contractual relationship is generally stored until the complete settlement of the contract, unless a statutory retention obligation or a legitimate interest requires longer storage.

• Statutory Retention Obligations

Numerous data are subject to statutory retention obligations that preclude earlier erasure. In particular, commercial-law periods under the German Commercial Code (HGB) and tax-law periods under the German Fiscal Code (AO) are relevant here. Depending on the type of document, they regularly amount to six to ten years from the end of the respective financial year. During these periods, the processing of the data is restricted and retained exclusively for the fulfilment of the statutory obligation to furnish evidence.

• Legitimate Interests

Storage beyond the aforementioned periods may take place insofar as we have a legitimate interest in the retention and this interest overrides the interests of the data subject worthy of protection. Such an interest may arise in particular from the establishment, exercise or defence of legal claims for the duration of the applicable civil-law limitation periods under the German Civil Code (BGB) – the standard limitation period is three years (Section 195 BGB), and in certain cases up to 30 years (Section 197 BGB) – as well as from preventing renewed contact following an objection or withdrawal, for example by maintaining a suppression list (e.g. for unsubscribed newsletter recipients). In these cases, we restrict the processing and delete the data as soon as the legitimate interest ceases to apply.

The specific erasure periods for individual processing activities result from our internal erasure and retention concept.

18 Data Subject Rights

You can assert the rights listed below. Your requests to exercise data protection rights and our responses to them are retained for documentation purposes for a period of three years after the end of the year in which we answered your request, and in individual cases, for the establishment, exercise or defence of legal claims, also beyond that. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting ourselves against claims or fines under Art. 82, 83 GDPR, as well as in fulfilling our accountability obligation under Art. 5 GDPR.

18.1 Right of Access, Art 15 GDPR

You have the right to request information from us about your stored personal data. This information covers the question of whether nooa processes / stores personal data about you and, among other things, which data is involved and for what purposes this data is processed. Upon request, nooa will provide you with a copy of the data.

18.2 Right to Rectification, Art. 16 GDPR 

In addition, you have the right to request the rectification of incorrectly stored data or the completion of incomplete data.

18.3 Right to Erasure, Art. 17 GDPR 

You also have the right to request the erasure of your personal data, provided that the statutory requirements provided for this are met. We are obliged to erase data, among other things, if your personal data is no longer necessary for the purposes for which it was collected or otherwise processed, if you have withdrawn consent once given, or if the data has been processed unlawfully.

18.4 Right to Restriction of Processing, Art. 18 GDPR 

Under the statutory conditions, you have the right to restriction of the processing of your personal data.

18.5 Right to Data Portability, Art. 20 GDPR

You have the right to have the data that you have provided to us on the basis of your consent or on the basis of a contractual relationship existing with you released to you in a machine-readable format or – at your choice – transferred to a third party.

18.6 Right to Object, Art. 21 GDPR

Right to Object in Individual Cases

Insofar as we process your data for the performance of a task carried out in the public interest, or processing takes place in the exercise of official authority (Art. 6(1)(e) GDPR), or the processing is based on legitimate interests of nooa (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

This also applies to profiling based on this provision within the meaning of Art. 4(4) GDPR. We will then cease the processing, unless we can demonstrate compelling legitimate grounds for the processing which override your interests in ceasing the processing.

Right to Object to Processing of Data for Direct Advertising Purposes

In individual cases, we process your personal data in order to carry out direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. This also applies to profiling insofar as it is connected with such direct advertising. If you object to processing for direct advertising purposes, we will no longer process your personal data for these purposes.

The objection can be made without any particular form and should be directed to:

nooa GmbH

Rheinkaistraße 1

68159 Mannheim

Germany

or to the following email address: privacy@nooa.app

18.7 Right to Withdraw Your Consent, Art. 7(3) GDPR

Insofar as we process your data on the basis of your consent, you have the right to withdraw your consent at any time. The lawfulness of the processing carried out on the basis of the consent up to the withdrawal remains unaffected by the withdrawal. You will be informed about your options for withdrawal when consent is given.

18.8 Contact Information for Exercising Data Subject Rights

To exercise your data subject rights, you can contact the following email address: privacy@nooa.app

18.9 Right to Lodge a Complaint, Art. 77 GDPR

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). You can assert this right with a supervisory authority in the Member State of your place of residence, your place of work or the place of the alleged infringement.

In Germany, in Baden-Württemberg – the registered office of nooa GmbH – the competent supervisory authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Lautenschlagerstraße 20

70173 Stuttgart

Germany

 

 

 

General Note

We reserve the right to change and adapt this privacy notice with effect for the future, for example if our processing activities or the legal requirements change.

Last updated: 7 September 2026