Privacy policy

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) and of other national data protection laws of the member states as well as of further data protection provisions is:

Neffe Consulting GmbH & Co. KG
Mommsenstraße 55
10629 Berlin
Deutschland

Telephone: +49 151 580 698 51
E-mail: info@neffe-consulting.de

Data protection officer

DSB | Bunzel Datenschutz – Julia Louisa Bunzel
Mommsenstraße 55
10629 Berlin
Telephone: +49 (0)30 88 77 36 18
E-mail: office@bunzel-datenschutz.de

2. Collection and storage of personal data, nature and purpose of their use

a) When visiting the website

When you call up our website, the browser on your device automatically sends information to our web server. This information is stored temporarily in what is known as a log file. The following information is recorded without any action on your part and stored until it is deleted automatically:

• IP address of the requesting computer
• date and time of access
• name and URL of the file retrieved
• website from which the access originates (referrer URL)
• the browser used and, where applicable, the operating system of your computer
• name of your access provider

We process these data for the following purposes: ensuring a smooth connection to the website, ensuring comfortable use of our website, evaluating system security and stability, and further administrative purposes.

The legal basis for the processing is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest follows from the purposes listed above. Under no circumstances do we use the collected data to draw conclusions about you as a person.

b) When registering a trial account

On the trial account page you can create an account for NCS-Staffing. Unlike merely visiting the site, your entries are transmitted to our server and processed there.

We process the name of your company, the address (subdomain) you chose, your e-mail address, the chosen package and the time of registration. The purpose is to set up the account you asked for and to send the invitation with which you set your password. The legal basis is Art. 6 (1) sentence 1 lit. b GDPR (performance of pre-contractual measures or of a contract).

These entries are passed on to the shared NCS-Cloud platform on which your account is created, and to the sign-in system operated there, which sends the invitation. Both are run by the same controller named under section 1 above; no transfer to third parties takes place in the process.

Your e-mail address is not used for advertising. If no contract comes of the trial, we delete the account and the data created with it upon your notice to us, and otherwise once statutory retention periods have expired.

c) Protection of the registration form

To prevent misuse of the form we limit the number of registration attempts per sender. For that purpose your IP address is processed in the memory of our server for the duration of the time window and is not stored permanently. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR; our legitimate interest lies in protecting the service against automated requests.

d) When contacting us by e-mail

On the contact page we give our e-mail address and our telephone number. There is no contact form there that transmits data to a server. If you write to us, we process the data you provide solely in order to deal with your enquiry. The legal basis is Art. 6 (1) sentence 1 lit. b GDPR where your enquiry is aimed at concluding or performing a contract, and otherwise Art. 6 (1) sentence 1 lit. f GDPR.

3. Disclosure of data

Your personal data are not transferred to third parties for purposes other than those listed below. We only pass your personal data on to third parties where you have given your express consent (Art. 6 (1) sentence 1 lit. a GDPR), the disclosure is necessary to assert, exercise or defend legal claims (Art. 6 (1) sentence 1 lit. f GDPR), there is a statutory obligation to disclose (Art. 6 (1) sentence 1 lit. c GDPR), or this is necessary for the performance of contractual relationships with you (Art. 6 (1) sentence 1 lit. b GDPR).

4. Hosting

This website is hosted by an external service provider. The data collected in the course of your visit (see section 2 a) are processed on the hoster's servers. The hoster processes these data solely on our behalf and on our instructions; this is contractually secured by a data processing agreement under Art. 28 GDPR.

Hosting provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany

5. Cookies, analysis and tracking tools

This website sets no cookies for analysis or advertising purposes. No web analysis services (such as Google Analytics or Matomo), no advertising or conversion tracking services and no social media plug-ins are used.

A technically necessary cookie is set as soon as you call up the registration form. It holds a random token with which we check that the submitted form actually comes from this website (protection against cross-site request forgery). It contains no information about you as a person, is not used for recognition, and is deleted when the browser is closed. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR, section 25 (2) no. 2 TDDDG.

A second technically necessary cookie is set only if you choose a language with the language switch. It stores that choice so that the site does not fall back to the language of your browser on the next page, and it is kept for one year. It contains nothing but the language code.

There is no newsletter registration. A consent banner (cookie consent) is therefore not required. Should such services be integrated in future, this privacy policy will be adapted beforehand.

6. Fonts

To display fonts consistently, this website embeds fonts from Google Fonts. When a page is called up, your browser loads the required fonts from a Google server. Your IP address is transmitted to Google in the process. The use serves a consistent and appealing presentation of our online offering, which constitutes a legitimate interest within the meaning of Art. 6 (1) sentence 1 lit. f GDPR. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

7. Rights of the data subject

You have the right:

• to request information about your personal data processed by us pursuant to Art. 15 GDPR;
• to request without delay the correction of inaccurate data or the completion of your personal data stored by us, pursuant to Art. 16 GDPR;
• to request the erasure of your personal data stored by us pursuant to Art. 17 GDPR, unless the processing is necessary to comply with a legal obligation or to assert, exercise or defend legal claims;
• to request the restriction of the processing of your personal data pursuant to Art. 18 GDPR;
• to receive your personal data in a structured, commonly used and machine-readable format, or to request their transmission to another controller, pursuant to Art. 20 GDPR;
• to withdraw consent once given at any time, pursuant to Art. 7 (3) GDPR;
• to complain to a supervisory authority pursuant to Art. 77 GDPR. As a rule you may turn to the supervisory authority of your usual place of residence or of our company's registered office.

8. Right to object

Where your personal data are processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, where there are grounds arising from your particular situation.

If you wish to exercise your right to object, an e-mail to info@neffe-consulting.de is sufficient.

9. Data security

Within your visit to the website we use the widespread SSL/TLS procedure in combination with the highest level of encryption supported by your browser. You can tell whether an individual page of our website is transmitted in encrypted form by the closed padlock symbol in your browser's address bar.

We otherwise employ suitable technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction, or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

10. Currency of and changes to this privacy policy

This privacy policy is dated November 2026.

The further development of our website and of the offerings on it, or changed legal or regulatory requirements, may make it necessary to amend this privacy policy. The current version can be called up on this page at any time.