Privacy notice

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

neonotu GmbH
Edelsbergstraße 8
80686 München
Germany
represented by its Managing Director, Armin Haller

You can reach us through "Ask us" on every page of this website or by mail at the address above. Further details are in the legal notice.

Hosting and server log files

This website is hosted by a hosting provider in Germany, on web space with servers located in Germany. We have a data processing agreement with the provider under Art. 28 GDPR.

Each time the site is accessed, the server automatically stores information in log files: IP address, date and time, the page requested, the amount of data transferred, the HTTP status code, the referrer URL, and your browser and operating system. We need this data to deliver the website, find errors and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Log files are deleted automatically after 14 days at the latest. We keep backups of the website, including the database, for 14 days and then overwrite them.

The connection to this website is encrypted with TLS. We protect our forms against spam without a captcha, and no additional data is passed to third parties for this purpose.

Web analytics with Matomo

We use the open-source software Matomo to understand which pages are read and how visitors find the website. Matomo runs on a dedicated server in Germany at sonar.netalytics.de. The data is not passed on to the maker of Matomo or to any other third party.

By default, Matomo works without cookies and without accessing information on your device. Your IP address is shortened before it is stored, so it cannot be linked to you. Among other things, Matomo records the pages viewed, time on page, referring page, device type, browser and approximate location at country level. The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR).

Matomo sets additional cookies only if you agree to them in the consent banner. These make it possible to recognize repeat visits. In that case the legal basis is your consent (Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG, and Art. 6(1)(a) GDPR). You can withdraw your consent at any time through the settings in the footer of the website.

If your browser has "Do Not Track" enabled, Matomo does not record your visit.

When you open one of our PDF sheets, our server reports this download to Matomo so we can see which documents are in demand. Only the PDF address, the referring page, the browser identifier and language setting are sent, without your IP address and without cookies. If "Do Not Track" is enabled, this report is not sent either. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

Analytics data is deleted after 13 months at the latest.

Ask us (chat assistant)

On every page you can ask a question through "Ask us". To generate an answer, we send your question together with relevant content from this website to the Claude API of Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Anthropic processes the data on our behalf. We do not pass on any other data about you in the process, such as your IP address.

Please do not enter personal data in the chat, meaning no names, contact details or information about other people. Keep your question general.

If the assistant cannot answer a question, it offers to pass it on to our team. The question then reaches us by email. If you would like a reply, you can provide an email address on a voluntary basis. Where needed, our answer is translated into your language and sent to that address. If we approve an answer, we add the question and answer to the assistant's knowledge base, without your email address.

The legal basis is our legitimate interest in answering questions about EU requirements quickly and without a form (Art. 6(1)(f) GDPR). For the reply to your email address, the legal basis is your request (Art. 6(1)(b) GDPR).

We base the transfer to the USA on the European Commission's adequacy decision for the EU-US Data Privacy Framework, provided Anthropic is certified under it. Otherwise, the transfer takes place on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

We store chat conversations for no more than 90 days in order to fix errors and detect misuse. Questions passed on to our team and your email address are deleted once the answer has been sent, and after 90 days at the latest. According to Anthropic, it stores inputs and outputs only for a limited period and does not use them to train its models.

Newsletter

For the free newsletter we need your email address and your choice of language and countries. After signing up, you receive an email with a confirmation link. We only add you to the list once you click that link (double opt-in). We store the time of sign-up and of confirmation, as well as the IP address used, so that we can prove your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every issue. We then delete your address from the mailing list. We keep the record of your earlier consent for up to three years so that we can defend ourselves against claims (Art. 6(1)(f) GDPR). Sign-ups that are never confirmed are deleted after 30 days.

The newsletter is sent through our own mail server at the hosting provider in Germany named above.

EU Readiness Check and PDF report

In the EU Readiness Check you answer questions about your company, such as industry, country and target market. You see the result right away in your browser. If you request the detailed report as a PDF, we need your email address and the details you enter in the form, for example your name and company.

We generate the report on our server and send it to you by email. The legal basis is your request for the report (Art. 6(1)(b) GDPR).

We transfer your contact details and the results of the check to our customer relationship management system, Twenty, which we run ourselves on servers in Germany. We use them there to answer follow-up questions about the report and to offer you suitable support. The legal basis is our legitimate interest in looking after prospective customers (Art. 6(1)(f) GDPR). You can object to this at any time.

If no business relationship develops, we delete data in the CRM no later than two years after the last interaction. If a contract is concluded, the statutory retention periods under commercial and tax law apply.

Company directory: account and listing

When you list your company in the company directory, we process the details from the form: company name, city, country, type and size of the company, services, categories, optionally website and VAT ID, as well as your name and email address. For the account we also store the language, the time of the last sign-in and the account status. You sign in with a link sent by email, without a password. While you are signed in, we set a technically necessary session cookie (section 25(2) TDDDG).

Only the company details are publicly visible. We do not show your name or email address. Our team reviews every listing and every change before publication. Texts containing phone numbers, email or web addresses are not accepted; in that case we store an excerpt of the text as a warning. We inform you by email about approvals, rejections and outstanding payments.

The legal basis is the contract for the listing (Art. 6(1)(b) GDPR) and, for the review and protection against abuse, our legitimate interest in a reliable directory (Art. 6(1)(f) GDPR). Accounts whose sign-in link has not been confirmed within 30 days are deleted together with the listing. If you delete your listing or account, we remove the data including images. We keep invoice and payment records for the statutory periods (up to ten years under section 147 AO and section 257 HGB).

Proof documents for the review

For the Business card and Microsite plans you upload proof, for example a tax number certificate or a business registration. These documents may contain personal data, such as the name of the owner. We store them separately from the website on our server in Germany. They are never public; only our team can view them after signing in.

We use the proof only to check that the company exists and that you act on its behalf. The legal basis is our legitimate interest in showing only verified providers and preventing fraud (Art. 6(1)(f) GDPR) as well as the contract (Art. 6(1)(b) GDPR). Once we have reviewed the proof, we delete the document. Only the result of the review (confirmed or rejected) is kept.

Inquiries to providers

You can write to a provider using the contact form of a listing. For this we process your name, your company, your email address, optionally country and subject, and your message. We first send you a confirmation link; only after you confirm do we forward the inquiry to the provider by email. For listings without their own account, it goes to our team, which establishes the contact.

We store the inquiry only until it is forwarded. Unconfirmed inquiries are deleted after seven days. So that you do not have to confirm every inquiry, we keep a non-reversible hash of your confirmed email address for 30 days. For the provider we only count the number of inquiries delivered. Once forwarded, the provider receives your details and is itself responsible for any further processing.

The legal basis is your inquiry (Art. 6(1)(b) GDPR) and our legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR). For this protection we limit the number of inquiries per IP address and per email address; we keep both for at most 24 hours for this purpose.

Payments via Mollie

We bill paid plans and ad placements through the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. For this we send Mollie the company name, the email address of the account, the amount and a description of the service. You enter your payment details, such as card number or bank account, directly with Mollie; we do not receive them. Mollie only tells us whether a payment was successful and the identifiers of the payment and subscription.

The legal basis is the contract (Art. 6(1)(b) GDPR). Mollie processes payment data as an independent controller to meet its own legal obligations, for example to prevent money laundering. You can find details in Mollie's privacy policy at www.mollie.com/en/privacy.

Recipients and transfers to third countries

Your data is received only by us and by the service providers named above who act on our behalf: the hosting provider in Germany and Anthropic for the chat assistant. Anthropic also translates our team's explanations in emails to providers into their language. Mollie in the Netherlands is involved in payments, and for inquiries in the company directory the provider you write to receives your message. Data is transferred to a country outside the EU only for the chat assistant and for translations, with the safeguards described there, and when you write to a provider outside the EU, at your own request (Art. 49(1)(b) GDPR). We do not sell data and do not pass it on for advertising purposes.

There is no automated decision-making, including profiling, under Art. 22 GDPR. The score in the EU Readiness Check is an assessment for your own use and has no legal or similarly significant effect.

Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), and the rights to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time, with effect for the future (Art. 7(3)).

Where we process data on the basis of our legitimate interest, you can object on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

To exercise your rights, write to us through "Ask us" or by mail to the address above.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

You are not required by law or contract to provide your data. Without an email address, however, we cannot send you a report, a newsletter or a reply to questions passed on to our team. An email address is required for a listing in the company directory and for inquiries to providers.