Controller pursuant to Art. 4(7) GDPR
hantha GmbH, Dick 48/B, 39058 Sarntal / Sarnthein, Südtirol – Italy
Email: info@nootiz.com
Security and protection of your data
We treat the confidentiality of the personal data you provide as a priority and protect it against unauthorised access.
As a private company we are subject to the European General Data Protection Regulation (GDPR 2016/679). We have implemented technical and organisational measures to ensure that data protection rules are observed by us and by our external service providers.
Legal bases for processing
We only process personal data on a legal basis under Art. 6(1) GDPR:
- Consent (lit. a) – e.g. for optional analytics and marketing cookies.
- Performance of a contract (lit. b) – providing your account, trial and subscription.
- Legal obligation (lit. c) – e.g. tax retention requirements.
- Legitimate interest (lit. f) – secure and stable operation of the website and service.
Data collected when visiting the website
For purely informational use we only collect the data your browser transmits to our server and that is technically necessary to display the website and ensure stability and security (Art. 6(1)(f) GDPR):
- IP address
- Date and time of the request and time zone difference to GMT
- Content of the request (specific page) and access status / HTTP status code
- Amount of data transferred and referring website
- Browser, operating system, language and browser version
Contacting us
If you contact us by email or through a form, we store the data you provide (email address, name and phone number where applicable) in order to answer your request (Art. 6(1)(b) and (f) GDPR). We delete this data once storage is no longer required, or restrict processing where statutory retention obligations apply.
Account, trial and subscription
To use nootiz you create an account. We process registration, usage and billing data in order to provide the service, deliver support and issue invoices.
Feedback content you or your clients create inside the tool is processed exclusively on your behalf as a processor within the meaning of Art. 28 GDPR.
Cookies
Necessary storage values are always set, optional ones only with your consent. A full list is available in the cookie policy.
Website hosting
The website is delivered via Lovable (Lovable Labs Incorporated) and the content delivery network of Cloudflare, Inc. The server log data listed above is processed to deliver the website securely and quickly (Art. 6(1)(f) GDPR). Transfers to the US are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
The typeface is served locally from our own server; there is no connection to Google Fonts.
Support form
Through the support form we process your name, email address, subject and message in order to answer your request (Art. 6(1)(b) and (f) GDPR). The data is stored in a database in the EU (Ireland, Amazon Web Services via Supabase). Confirmation and internal notification emails are sent via Resend (Plus Five Five, Inc., USA; EU-US Data Privacy Framework / EU Standard Contractual Clauses).
A hidden field and a timing check protect the form against spam; no additional personal data is collected for this. We delete requests no later than 12 months after they have been resolved, unless statutory retention obligations apply.
Google Tag Manager and Google Analytics 4
Only with your consent (Art. 6(1)(a) GDPR) do we load Google Tag Manager and Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use them to analyse how the website is used (e.g. page views, button clicks) in order to improve content and offering. We use Google Consent Mode v2: without consent no Google scripts are loaded and no cookies are set.
Data processed includes truncated IP address, device and browser information, pages visited and interactions. Cookies: _ga and _ga_* (retention up to 2 years). A transfer to Google LLC in the US is possible; Google is certified under the EU-US Data Privacy Framework. Data in Google Analytics is deleted after 14 months.
You can withdraw your consent at any time via “Cookie settings” in the footer.
Leadfeeder
Only with your consent (Art. 6(1)(a) GDPR) do we use Leadfeeder by Dealfront Finland Oy, Mikonkatu 17 C, 00100 Helsinki, Finland. Leadfeeder matches visits to publicly available company data based on the IP address so we can see which companies are interested in nootiz. Individual persons are not identified.
Cookie: _lfa (retention up to 2 years). Processing takes place in the EU. If you withdraw consent via the cookie settings, the cookie is deleted.
Recipients and processors
In addition to the services above, for the nootiz software (app.nootiz.com) we use Vercel Inc. (hosting) and MongoDB, Inc. (database) as processors, as well as Resend for system emails. Payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland) as an independent controller. Data processing agreements under Art. 28 GDPR are in place with all processors; transfers to third countries only take place based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Details are in our DPA.
Retention
We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods (e.g. tax law). Afterwards the data is deleted or anonymised.
Data in the app.nootiz.com tool: after termination you can export your data for 30 days, after which it is permanently deleted. It is removed from backups no later than 30 days after that. Invoicing data is retained for the duration of statutory obligations.
Your rights
Under the GDPR you have the following rights:
- Access to the data we process (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17) and restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection to processing based on legitimate interests (Art. 21)
- Withdrawal of consent with effect for the future (Art. 7(3))
- Lodging a complaint with a supervisory authority (Art. 77)
Data Processing Agreement (DPA)
For feedback content in the tool we act as a processor. Our DPA under Art. 28 GDPR is deemed agreed when you start a plan – no signature required (Art. 28(9) GDPR). It includes the technical and organisational measures and the list of sub-processors.
Privacy contact
For privacy enquiries please write to info@nootiz.com.