Privacy policy

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Andrii Brodskyi (sole proprietor, trading as “Nordlicht Agency”), Lychener Str. 74, 10437 Berlin, Germany.

Email: termin@nordlicht.agency · Phone: +49 176 55050925. You can contact us at any time using these details for data-protection matters. A data protection officer is not required by law, as the statutory conditions for one are not met.

We process personal data only where necessary to provide a functional website and our content and services, or where you have consented. Personal data is any information relating to an identified or identifiable person.

Depending on the case, the legal bases are: your consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual measures (b), compliance with legal obligations (c) and our legitimate interests in secure, efficient and user-friendly operation (f). Where special provisions apply, they take precedence (e.g. § 25 TDDDG for access to information on your device).

When you access our website, our hosting provider automatically collects technically necessary access data (e.g. IP address, date and time of access, page requested, data volume transferred, referrer URL, browser type and operating system) in server log files. Processing serves to deliver the site and to ensure security, stability and smooth operation (Art. 6(1)(f) GDPR).

The website is hosted with Vercel Inc. (USA); for DNS as well as security and CDN services we use Cloudflare, Inc. (USA). Data processing agreements pursuant to Art. 28 GDPR are in place with both providers; the transfer to the USA is safeguarded by the EU standard contractual clauses. Static content is delivered via Cloudflare's globally distributed CDN from the nearest location; processing at the origin (hosting with Vercel) takes place in a data centre within the EU (Frankfurt region). Log files are automatically deleted after a short time.

When you contact us via the contact form, by email or by phone, we process the data you provide (e.g. name, email address, optional company, topic and message) solely to handle and respond to your enquiry and to initiate or perform a contract (Art. 6(1)(b) or (f) GDPR).

For technical delivery of form messages we use the provider Resend (Resend, Inc., USA); a data processing agreement is in place and the transfer to the USA is safeguarded by EU standard contractual clauses. Your enquiry data is deleted once it is no longer required and no statutory retention obligations (e.g. commercial or tax law) apply.

For optional online appointment booking we link to Calendly (Calendly, LLC, USA); for optional contact via messenger we link to WhatsApp (WhatsApp Ireland Ltd. / Meta Platforms). You only use these services if you actively click the relevant link.

The data you enter (e.g. name, email, preferred time or message) is then transmitted to the respective provider and processed there under its privacy policy (Art. 6(1)(a) or (f) GDPR); transfers to third countries are safeguarded by standard contractual clauses. You can always simply reach us by email or phone instead.

You can voluntarily leave a review on our website. In doing so we process the data you provide (name, optional role/company, star rating and review text) on the basis of your consent to publication (Art. 6(1)(a) GDPR). We base the internal check/moderation on our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

After you submit it, we store your review on our server; until our moderation it is not publicly visible (non-public draft). Reviews that are not approved or that we reject are deleted after moderation is completed; approved reviews remain published until you withdraw your consent and are removed afterwards. To be notified of new reviews we use the email provider Resend (see section 4). Your browser additionally stores your review draft locally (localStorage) so you can see its status; you can delete this local storage yourself at any time. You can withdraw your consent to publication at any time with effect for the future — we will then remove the review.

We use only technically necessary cookies and storage techniques without consent — for example to remember your cookie choice, language and appearance settings. These are required for the operation of the website (§ 25(2) TDDDG, Art. 6(1)(f) GDPR).

Optional services (statistics) are activated only after your explicit consent pursuant to § 25(1) TDDDG. You can change or revoke your choice at any time via “Cookie settings” in the footer. We also use your browser's local storage (localStorage) for your settings and your review draft; this data remains on your device and is not transmitted to us.

Where enabled, we use the privacy-friendly, cookieless analytics solution Plausible Analytics (EU hosting). It is loaded only after your consent to the “Statistics” category (Art. 6(1)(a) GDPR); without consent no analysis takes place.

Plausible builds no personal profiles, sets no cookies and enables no cross-device recognition. Only aggregated, anonymous usage statistics are collected (e.g. page views, approximate origin, browser used).

We link to profiles on social networks (e.g. LinkedIn, Instagram, GitHub). These are simple links without embedded content or tracking plugins — no data is transmitted to these providers until you actively click the relevant link and open the page there. From that point, the privacy policy of the respective network applies.

This website uses SSL/TLS encryption (recognisable by “https://” and the padlock symbol in your browser) to protect the transmission of your data. In addition, we take appropriate technical and organisational measures (Art. 32 GDPR) to protect your data against loss, manipulation and unauthorised access, and continuously adapt them to the state of the art.

We disclose personal data only where necessary to perform a contract, where you have consented or where we are legally obliged to do so. Processors we use (hosting, email delivery) are contractually bound under Art. 28 GDPR. The linked services Calendly (appointment booking) and WhatsApp (messenger) are only used if you actively click; these providers process your data as independent controllers under their own privacy policies — we have no data processing agreements with them for this.

Where we ourselves transfer data to processors in the USA (Vercel, Cloudflare, Resend), this takes place on the basis of the EU standard contractual clauses and supplementary safeguards. Beyond this, no transfer to third countries without an adequate level of data protection takes place.

Under the GDPR you have extensive rights: access to the data stored about you (Art. 15), rectification of inaccurate data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw any consent given at any time with effect for the future (Art. 7(3)).

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

Right to complain: you can lodge a complaint with a data protection supervisory authority at any time — the one responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin (www.datenschutz-berlin.de).

We store personal data only as long as necessary for the stated purposes or as required by statutory retention periods (in particular commercial and tax law); thereafter the data is deleted or blocked.

We update this privacy policy whenever changes to our data processing or the legal situation require it. The version published on this page applies in each case.