Privacy policy
Last updated: 22 August 2026
1. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
N-2V — Tomasz Morawski
Nienredder 5A
22527 Hamburg
Germany
Email: info@n-2v.com
Phone: +49 176 649 80512
VAT ID: DE406562388
We are not legally required to appoint a data protection officer.
2. General principles
We process personal data only where it is necessary to provide a functioning website and our content and services, or where you have given your consent. Personal data means any information relating to an identified or identifiable natural person.
Legal bases. Where we obtain consent, Art. 6(1)(a) GDPR is the legal basis. For processing necessary to perform a contract or to take steps at your request prior to entering into a contract, Art. 6(1)(b) GDPR applies. Where we are subject to a legal obligation, Art. 6(1)(c) GDPR applies. Processing based on our legitimate interests rests on Art. 6(1)(f) GDPR; we name the specific legitimate interest at each processing activity below.
Storing information on your device. Where we store information on your device or access information already stored there — in particular through cookies — we do so only with your consent, in accordance with § 25(1) TDDDG (the German Telecommunications Digital Services Data Protection Act). This does not apply to operations that are strictly necessary to provide a service you have expressly requested (§ 25(2) TDDDG).
Erasure. We erase personal data as soon as the purpose for storing it no longer applies, consent is withdrawn, or a statutory retention period expires. Specific periods are given at each processing activity and summarised in section 18.
3. Hosting and delivery of the website (Shopify)
This website runs on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, which in turn involves Shopify Inc., 151 O'Connor Street, Ottawa, Ontario, K2P 2L8, Canada.
When you access the site, Shopify collects technically necessary access data on our behalf (server log files): IP address, date and time of access, page requested, volume of data transferred, referrer URL, and browser and operating system information. This data is required to deliver the website, ensure its stability and security, and defend against attacks.
To deliver the site, Shopify sets the strictly necessary cookies _shopify_y, _shopify_s, cart_currency and localization (your language and region choice).
Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: secure, stable and efficient provision of our online offering. For storing the necessary cookies listed above: § 25(2)(2) TDDDG.
A data processing agreement under Art. 28 GDPR is in place with Shopify. Transfers to Canada are covered by an adequacy decision of the European Commission, supplemented by Standard Contractual Clauses. Log files are deleted or anonymised after no more than 30 days.
Shopify privacy policy: https://www.shopify.com/legal/privacy
4. Consent management (cookie banner)
When you first visit our website, a consent banner asks you to decide which non-essential cookies and services may be used. Your decision is stored so that you are not asked again on every page. Without your consent, the services described in sections 9 to 15 are not loaded.
You may withdraw or change your consent at any time with effect for the future by reopening the cookie settings via the link in the site footer. The lawfulness of processing carried out before withdrawal is unaffected.
Legal basis for storing your decision: § 25(2)(2) TDDDG and Art. 6(1)(c) GDPR (obligation to demonstrate consent under Art. 7(1) GDPR). Consent records are kept for as long as that obligation applies.
5. Contact and the contact form (HubSpot)
Our contact pages provide a form that is delivered and processed technically by HubSpot. The provider is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, together with HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.
We collect: first name, last name, company email address, your message, and optionally your selection in the „Interested in“ field. Technically, your IP address, the time of submission and the page you submitted from are also recorded.
We use this data solely to handle and respond to your enquiry. The details are stored in our customer relationship management system (CRM) at HubSpot so that we can follow the history of our correspondence. An internal task is also created in our project system ClickUp (Mango Technologies, Inc., 350 Tenth Ave, San Diego, CA 92101, USA) containing your name, email address and message, so that your enquiry is not overlooked.
After submitting the form you receive an automatic acknowledgement by email.
Legal basis: Art. 6(1)(b) GDPR where the enquiry is directed at entering into or performing a contract; otherwise Art. 6(1)(f) GDPR, with the legitimate interest in answering enquiries and organising our business correspondence properly.
Retention: enquiries that do not lead to a business relationship are deleted no later than 24 months after the last contact. Where a business relationship is established, commercial and tax retention periods of six and ten years respectively apply.
The form is protected against automated submissions by Google reCAPTCHA (see section 16).
6. Marketing communications (consent given in the form)
The contact form lets you consent separately to receiving further communications from n-2v.com and n-2v.de. This consent is voluntary and is not a condition of us handling your enquiry.
On the basis of that consent we send you information about our services and content. Delivery is handled by HubSpot, which records whether an email was delivered and opened and whether links in it were clicked, so that we can judge how relevant our communications are.
Legal basis: Art. 6(1)(a) GDPR. You may withdraw this consent at any time, using the unsubscribe link in every email or by writing to info@n-2v.com. After withdrawal we keep your email address on a suppression list to ensure you receive no further communications (Art. 6(1)(c) GDPR).
7. GRID-OS Digital Friction Check
We offer a self-assessment tool on our website (the „GRID-OS Digital Friction Check“). You answer questions about your digital set-up and then receive a score (the „Digital Alignment Score“) and a result email.
We process your answers, the score calculated from them, and the contact details you provide. The evaluation is rule-based and follows a fixed scoring scheme. No automated decision producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR takes place — the result is a non-binding indication, not a decision about you.
Answers and the result are attached to your contact record in HubSpot so that we can prepare a conversation properly.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Retention as in section 5.
8. Appointment booking (HubSpot Meetings)
You can book a call through the scheduling calendar at meetings.hubspot.com. Your name, email address, the time slot chosen and any details you enter in the booking form are transmitted to HubSpot and stored in our calendar. Provider and legal basis as in section 5.
9. HubSpot tracking, Collected Forms and ads pixel
Beyond the contact form, we use HubSpot's analytics and marketing tracking. This sets the cookies hubspotutk, __hstc, __hssc and __hssrc and loads scripts from js.hs-scripts.com, js.hs-analytics.net, js.hscollectedforms.net and js.hsadspixel.net.
It records your repeat visits, the pages you view, time spent, the source that brought you to the site, and interactions with forms on our website. This information is linked to your contact record once you submit a form — including retrospectively, for page views before that submission. The ads pixel is used to measure advertising performance.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG — used only with your consent given via the consent banner. You can withdraw at any time via the cookie settings in the footer.
HubSpot privacy policy: https://legal.hubspot.com/privacy-policy
10. Google Tag Manager
We use Google Tag Manager (container ID GTM-KRL7WPWJ) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself creates no user profiles and stores no cookies; it serves only to manage the services described below and — according to your selection in the consent banner — to load or block them.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
11. Google Analytics 4
We use Google Analytics 4 (measurement ID G-H9Y3GB9V36) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics sets the cookies _ga and _ga_H9Y3GB9V36 and processes, among other things, your truncated IP address, the pages you view, time spent, scroll and click interactions, traffic source, approximate location (country/region), device type, browser and operating system. We use this data to understand how our website is used and to improve it. IP anonymisation is active by default in Google Analytics 4.
Through Shopify's Google sales channel integration, an additional measurement stream is sent to merchant-center-analytics.goog (MC-C9CQZLDTSM, cookie _ga_C9CQZLDTSM).
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Used only with your consent; withdrawal at any time via the cookie settings.
Retention of usage data at Google: 14 months.
Privacy policy: https://policies.google.com/privacy
Browser opt-out add-on: https://tools.google.com/dlpage/gaoptout
12. Google Ads and conversion measurement
We use Google Ads services to measure the effectiveness of our advertising. This may set the cookie _gcl_au and open connections to stats.g.doubleclick.net and www.google.de. It records whether, after clicking one of our ads, you took an action relevant to us on our website (for example, submitting the contact form). We do not attribute this to you personally.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
13. Meta Pixel (Facebook)
We use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This sets the cookie _fbp and opens connections to connect.facebook.net and www.facebook.com.
The pixel records your visit and your interactions on our website and transmits them to Meta. Meta can attribute this information to your user account if you are logged in to Facebook or Instagram, and use it to deliver and measure advertising and to build audiences. For the collection and transmission of this data, we and Meta are joint controllers within the meaning of Art. 26 GDPR; the essential content of that arrangement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for the processing that follows.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Privacy policy: https://www.facebook.com/privacy/policy
14. Hotjar
We use Hotjar provided by Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta (site ID 5289170). This sets the cookies _hjSessionUser_5289170 and _hjSession_5289170 and opens connections to static.hotjar.com, script.hotjar.com, content.hotjar.io and metrics.hotjar.io.
Hotjar records mouse movements, clicks, scrolling and page views, producing pseudonymised recordings of individual sessions and aggregated heatmaps. It also records device type, screen resolution, browser, operating system, approximate location (country) and a truncated IP address. We use these analyses to improve how clear and usable our pages are. Input into form fields is suppressed by default and is not recorded.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Privacy policy: https://www.hotjar.com/legal/policies/privacy
Opt-out: https://www.hotjar.com/legal/compliance/opt-out
15. Pinterest tag
Shopify's Pinterest integration may load the Pinterest tag provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. This sets the cookies _pin_unauth and _derived_epik. It records your visit to our website in order to measure the reach and performance of content on Pinterest and to build audiences.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Privacy policy: https://policy.pinterest.com/en/privacy-policy
16. Google reCAPTCHA
To protect our forms against automated submissions (spam) we use reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This opens connections to www.google.com and www.gstatic.com and transmits your IP address and interaction data (mouse movements, time spent, browser and device information) to Google in order to assess whether the input comes from a human.
Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: protecting our website and forms against abusive automated use and spam.
17. Other embedded services
Google Fonts and Google Hosted Libraries. In connection with the contact form and the services named in sections 9 to 15, fonts and program libraries are loaded from fonts.googleapis.com and ajax.googleapis.com (Google Ireland Limited). Your IP address is transmitted to Google in the process. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a functioning presentation of the form.
Shop Pay / shop.app. As part of the Shopify platform, a connection to shop.app may be established. Provider and legal basis as in section 3.
LinkedIn. Our „About“ page links to our founder's LinkedIn profile. This is a plain hyperlink; no data is transmitted to LinkedIn until you click it.
18. Recipients, processing on our behalf, and international transfers
We disclose personal data only where it is necessary for the purposes described. The recipients are:
| Recipient | Purpose | Location |
|---|---|---|
| Shopify International Ltd. / Shopify Inc. | hosting, delivery of the website | Ireland / Canada |
| HubSpot Ireland Ltd. / HubSpot, Inc. | forms, CRM, email, tracking, scheduling | Ireland / USA |
| Google Ireland Ltd. | Analytics, Tag Manager, Ads, reCAPTCHA, Fonts | Ireland (group: USA) |
| Meta Platforms Ireland Ltd. | reach measurement and advertising | Ireland (group: USA) |
| Pinterest Europe Ltd. | reach measurement and advertising | Ireland (group: USA) |
| Hotjar Ltd. | usage analysis | Malta |
| Mango Technologies, Inc. (ClickUp) | internal task management | USA |
Data processing agreements under Art. 28 GDPR are in place with all providers that process data on our behalf.
Where data is transferred to the USA, we rely on the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) where the provider concerned is certified, supplemented by the European Commission's Standard Contractual Clauses and additional safeguards. An adequacy decision is in place for Canada. We note that, despite these mechanisms, access by authorities in third countries cannot be entirely ruled out.
Retention periods at a glance
| Data | Period |
|---|---|
| Server log files | max. 30 days |
| Enquiries with no business relationship | max. 24 months after last contact |
| Data from a business relationship | 6 or 10 years (§ 257 HGB, § 147 AO) |
| Marketing consent | until withdrawn; suppression list indefinitely |
| Google Analytics usage data | 14 months |
| Consent records | for as long as the obligation to demonstrate consent applies |
19. Your rights
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR) — what data we process about you
- Rectification (Art. 16 GDPR) — correction of inaccurate data
- Erasure (Art. 17 GDPR) — the „right to be forgotten“
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) — a copy in a common format
- Withdrawal of consent (Art. 7(3) GDPR) — at any time, with effect for the future
An informal message to info@n-2v.com is enough to exercise any of these.
Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Where your personal data is processed for direct marketing purposes, you have the right to object at any time to that processing, including profiling to the extent that it is related to such direct marketing. If you object, your data will no longer be used for direct marketing purposes.
Right to lodge a complaint. Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 7th floor
20459 Hamburg, Germany
Phone: +49 40 428 54-4040
Email: mailbox@datenschutz.hamburg.de
20. Whether you have to provide data
Providing your data is neither required by law nor by contract. However, we need the details marked as mandatory in the contact form in order to handle and answer your enquiry; without them we cannot reply. All other details are voluntary.
21. Automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
22. Data security
We use SSL/TLS encryption for data transmitted through this website, which you can recognise in your browser's address bar. We also take appropriate technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access. Please note that data transmission over the internet can have security gaps and that complete protection against access by third parties is not possible.
23. Changes to this privacy policy
We update this privacy policy whenever the legal situation, our processing activities or the services we use change. The version published on this page applies. The date of the last change is shown at the top.