Privacy Notice

1. Controller

The controller responsible for data processing on this website is:

Tobias Grawinkel (nuuminds)
Driesener Straße 8 B
D-10439 Berlin

2. Your Rights

Subject to the legal requirements, you have the following rights:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• lodging a complaint with a supervisory authority (Art. 77 GDPR), for example the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, which is responsible for me

An informal message to the contact details above is enough for any request.

3. Your Right to Object

Where I process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons. An informal message to the contact details above is enough.

4. Visiting the Website

The website is hosted on Firebase Hosting by Google and delivered through a global network, including locations outside the EU. When you visit, technically necessary connection data is processed, in particular your IP address, the time, the requested address and browser details. According to Google, it retains Firebase Hosting IP data for a few months.

When you submit a form, open a result or save your cookie choice, this runs through Google Cloud Functions in Frankfurt (region europe-west3). This creates logs with IP address, time, browser details, the domain of the calling page and the function called, which are deleted after 30 days. The database (Cloud Firestore) is also located in Frankfurt.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is the secure and stable operation of the website. I serve fonts and images from this domain. Visiting the pages does not load external fonts, videos or social media content.

5. Cookies and Browser Storage

I only store the following on your device. This only happens once you use the respective function:

• Cookies cookieBannerDisplayed and analyticalCookiesAccepted: Store your choice in the cookie banner so I do not ask again on every visit. Duration 60 days.
• Cookie consentId: Links your consent and its withdrawal to the log described below. Only created when you consent. Duration 60 days.
• localStorage theme: Stores the display mode when you actively change it. Stays until you delete it in your browser.
• sessionStorage smart-audit-draft: Draft of the AI Readiness Check with your answers and contact details so that nothing is lost on reload. Stays on your device only and ends when you submit or close the tab.
• sessionStorage nuuminds:pending-hash-scroll: Remembers the section you want to jump to when changing pages. Ends when you close the tab.

The legal basis is Section 25(2) No. 2 TDDDG because these storage operations are strictly necessary for the function you request.

I document your consent and its withdrawal on the server with a consent ID, the decision, the time and the page. I do not log a refusal without earlier consent. The consent itself lasts 60 days. The log proves it beyond that and is deleted automatically 365 days after the last change, usually within the following 24 hours. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is being able to demonstrate consent under Art. 7(1) GDPR. To prevent abuse, I count requests per hour using a pseudonymized hash of the IP address, which is typically deleted within 25 hours.

6. Audience Measurement with Matomo

I only load Matomo if you consent in the cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent lasts 60 days. You can withdraw it at any time using the Cookies link in the footer. The page then reloads and Matomo no longer starts.

I run Matomo myself on a server of ALL-INKL.COM in Germany. It does not set tracking cookies. It records your IP address, the page visited, the previous page, the page title, the time, screen resolution, browser and device data, load times and clicks on external links and downloads. Several page views can be grouped into one visit using technical characteristics. The measurement is therefore not anonymous but data-minimizing. I remove the access code of result links before anything is sent.

I store the data for as long as I need it to evaluate reach. More information: BfDI on Matomo (German).

7. Contact Form, Email and Telephone

Through the contact form, I process your request, where applicable the topic, entry point, company size and message, as well as your name, company and email address. The request reaches me as an email via Resend in my Google Workspace inbox. A confirmation goes to the address you entered, with a booking link if you asked for a call. I use the same inbox when you write to me directly.

The legal basis is Art. 6(1)(b) GDPR where your request relates to a service or contract, otherwise Art. 6(1)(f) GDPR. My legitimate interest is answering requests and preventing abuse of the form. For this I count requests using pseudonymized hashes of the IP address (one hour) and email address (seven days), which are then typically deleted within 24 hours.

I keep messages for as long as I need them to handle your request or for a possible collaboration and for as long as statutory retention duties apply. Resend stores sent emails for 30 days. You are not obliged to give me any data. Without a name and email address, however, I cannot reply. A request is not consent to marketing emails.

8. AI Readiness Check (Smart Audit)

For the free AI Readiness Check, I process:

• your answers including any free text and the scores and stages calculated from them
• name, company and email address
• the selected language and the time

The server calculates your assessment using fixed rules. No AI provider is involved and there is no automated decision within the meaning of Art. 22 GDPR. You receive a personal result link by email, which is valid for 30 days. Anyone who has the link can see the assessment with your selected answers but not your contact details or any free text, so only share it deliberately. The link contains a random access code, which like any requested address can appear in the connection data described in section 4.

I receive an email with your name, company, company size, email address, motivation, scores and result link so I can classify requests and prepare for a possible conversation. The record is deleted automatically after 90 days, usually within the following 24 hours. Until then I need it for follow-up questions and a possible conversation. I keep the email in my inbox for as long as I need it for this purpose and for as long as statutory retention duties apply.

To prevent abuse, I count requests and submissions using pseudonymized hashes of the IP address (up to 25 hours) and email address (seven days). I also check via DNS whether the domain of your address can receive email. The hashes are then typically deleted within 24 hours.

The legal basis is Art. 6(1)(b) GDPR for the assessment you request and Art. 6(1)(f) GDPR for everything else. My legitimate interest is classifying requests, preparing conversations and preventing abuse. You are not obliged to use the check. Without contact details I cannot create an assessment for you. Taking part is not consent to marketing emails.

9. Appointment Booking

If you click a booking link, a Google Calendar booking page opens. There is no connection to Google before the click. The Google Privacy Policy applies to processing on that page. I manage the booked appointment and your details in my Google Workspace calendar. The call takes place via Google Meet. The legal basis is Art. 6(1)(b) GDPR. Current booking link: https://calendar.app.google/FNGWARTDFE3pEovP9.

10. Social Media and External Links

This website does not embed social plugins. It only contains links to LinkedIn, Instagram, X and WhatsApp. The respective provider only processes your data once you click a link. The provider is itself responsible for that.

If you visit my profiles, the provider and I may be joint controllers for the statistics about those profiles (Art. 26 GDPR). I only receive aggregated figures, no raw data about individual visitors. The essentials are set out in the Page Insights Addendum for LinkedIn and the Insights Addendum for Meta. The easiest way to exercise your rights is directly with the provider.

If you write to me on one of these platforms, I see your profile name and your message. On WhatsApp I also see your phone number. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is making my services known and getting in touch with interested parties. If you do not want this, please email me instead.

• LinkedIn: Privacy Policy
• Instagram: Privacy Policy
• X: Privacy Policy
• WhatsApp: Privacy Policy

11. Recipients and Transfers to Third Countries

• Google Cloud EMEA Limited, Dublin, Ireland: Firebase Hosting, Cloud Functions, Cloud Firestore and Google Workspace (email, calendar, video calls). More information: Firebase Privacy and Cloud Data Processing Addendum.
• Plus Five Five, Inc. (Resend), San Francisco, USA: Sending the emails from the forms. Sending runs via Ireland, while Resend stores contents and logs in the USA. More information: Resend GDPR.
• ALL-INKL.COM - Neue Medien Münnich, Friedersdorf, Germany: Server for Matomo. More information: Privacy information (German).

Data is transferred to the USA at Resend. At Google, data may be processed outside the EU as part of operations and support and through the global delivery described in section 4. For this I rely on adequacy decision (EU) 2023/1795 on the EU-US Data Privacy Framework, in which Google LLC and Plus Five Five, Inc. participate (list of participants). In addition, the data processing terms of both providers include EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. You can find them via the links above or get them from me on request.

Last updated: 06.11.2026