Privacy Policy

1. Scope

This policy covers your use of nephelix.com, including the German-language pages under nephelix.com/de/. Personal data processed during a client engagement is governed by the agreement with the client and, where applicable, a separate data processing agreement under Article 28 GDPR.

2. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Nephelix Nova Ltd.
Centris Business Gateway, Level 4/W
Triq is-Salib tal-Imriehel, Zone 3
Birkirkara, CBD 3020, Malta
Email: jp@nephelix.com

3. Data Protection Officer

No Data Protection Officer has been appointed because the legal requirements of Article 37 GDPR are not met: Nephelix Nova Ltd. is a small company, does not conduct regular and systematic monitoring of data subjects on a large scale, and does not process special categories of personal data on a large scale. For data protection enquiries, please contact the controller directly at the address above.

4. Overview of Data Processed

• Server log data: IP address, browser type and version, operating system, referrer URL, requested URL, date and time of access. These are processed by Cloudflare as our hosting provider (section 5). We operate no server of our own, have no access to these logs, and keep no logs ourselves.
• Aggregate usage data: requested URL, referrer, browser, operating system, device type, country, and page performance timings, measured without cookies by Cloudflare Web Analytics (section 5). Query strings are not recorded.
• Email correspondence: Name, email address, company name, and message content when you voluntarily contact us by email
• Appointment booking data: Name, email address, the slot you select, and anything you enter into the booking form, together with the calendar entry created from it
• Appointment communication and call data: The confirmation and reminder emails for the appointment, and the connection, audio and video data processed during the Google Meet call

5. Hosting and Delivery (Cloudflare)

This website is delivered via Cloudflare Pages (Cloudflare, Inc., USA). When you visit, Cloudflare receives standard access data: IP address, browser information, referrer, requested URL, and access time. This is necessary to deliver the site and to protect against abuse. Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure operation). A data processing agreement under Article 28 GDPR is in place (Cloudflare Standard DPA).

Cloudflare Web Analytics: to see which pages are read and how the site performs, we use Cloudflare Web Analytics. It reports page views and performance timings to Cloudflare. It sets no cookies, stores nothing on your device, assigns you no identifier, and does not follow you across other websites; the measurement is aggregated and we cannot single you out from it. Legal basis: Article 6(1)(f) GDPR (legitimate interest in understanding which content is useful and whether the site is fast enough). Cloudflare acts as our processor under the data processing agreement named above. You may object at any time under Article 21 GDPR — see section 12.

Transfer to the USA: Cloudflare is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and additionally relies on EU Standard Contractual Clauses. Details: Cloudflare's Privacy Policy.

Wherever this policy relies on EU Standard Contractual Clauses, you can obtain a copy of them from us on request. An informal email to the address in section 2 is enough.

6. Email Contact

If you contact us by email, we process the data you provide (name, email address, company, message content) to respond to your enquiry. Legal basis: Article 6(1)(b) GDPR (pre-contractual measures) where your enquiry concerns a possible engagement, otherwise Article 6(1)(f) GDPR (legitimate interest in responding to enquiries). We retain the data until you request deletion or the purpose no longer applies, subject to statutory retention obligations.

Email hosting (Google Workspace): our business email is hosted on Google Workspace, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) with sub-processing by Google LLC (USA). Google stores and processes incoming email on our behalf under a data processing agreement pursuant to Article 28 GDPR (Google Workspace Data Processing Addendum). Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and additionally relies on EU Standard Contractual Clauses. Details: Google's Privacy Policy.

7. Appointment Booking (Google Calendar)

The "Book a discovery call" buttons on this website link to an appointment page that Google hosts on its own domain (calendar.app.google). Simply reading this website transmits nothing to Google; data is only processed once you follow the link and book.

If you book, we process the details you enter — your name, email address, the slot you select, and anything you write into the booking form — together with the calendar entry created from them and the confirmation and reminder emails sent about the appointment. Purpose: arranging and holding the discovery call. Legal basis: Article 6(1)(b) GDPR (pre-contractual measures taken at your request). Without a name and an email address the appointment cannot be confirmed; anything else you write is optional.

Processor: the appointment schedule runs on Google Calendar inside our Google Workspace account, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) with sub-processing by Google LLC (USA). The same data processing agreement pursuant to Article 28 GDPR applies as in section 6 (Google Workspace Data Processing Addendum). Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and additionally relies on EU Standard Contractual Clauses. For the booking data Google acts as our processor; for the operation of the booking page itself it is the controller in its own right (see section 8).

Google Meet: the confirmed appointment includes a Google Meet link, so the call itself takes place over Google Meet — a separate processing step on the same legal basis and under the same Workspace agreement. When you join, Google processes your connection data and the audio and video transmitted for the duration of the call. We do not record calls.

8. Cookies and Local Storage

This website sets no analytics, marketing, or tracking cookies. The usage measurement described in section 5 is cookieless and stores no identifier on your device. We therefore treat it as falling outside the consent requirement in Article 5(3) of Directive 2002/58/EC, which concerns storing information on, or gaining access to information already stored in, your device. Where Cloudflare's bot protection is active, Cloudflare may set cookies of its own for bot detection and challenge handling — typically __cf_bm (30-minute lifetime), and, where a challenge is served, cf_clearance. These are set by Cloudflare as our processor, carry no analytics or advertising function, and are strictly necessary for the service you requested and therefore exempt from consent under Article 5(3) of Directive 2002/58/EC, transposed in Malta by S.L. 586.01 and in Germany by § 25(2) No. 2 TDDDG.

Until you use the light/dark control in the header, nothing at all is stored on your device and the site simply follows your operating system's setting. Once you use it, your choice is saved in your browser's local storage under the key theme — the single value light or dark, and nothing else. It never leaves your device, is not transmitted to any server, and exists only to keep the setting you explicitly asked for — strictly necessary for the service you requested and therefore exempt from consent under Article 5(3) of Directive 2002/58/EC, transposed in Malta by S.L. 586.01 and in Germany by § 25(2) No. 2 TDDDG. You can remove it at any time through your browser's site-data settings.

On the booking page: the appointment page described in section 7 is operated by Google on its own domain. Google sets cookies there and acts as the controller for that visit under Google's Privacy Policy. This policy covers the booking data that reaches us.

9. Provision of Your Data

Providing personal data is neither required by law nor by contract. You do not have to contact us. Without your details we cannot answer an enquiry or arrange a call.

10. Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

11. Your Rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access (Article 15 GDPR) — You may request confirmation of whether personal data concerning you is being processed and, if so, obtain access to that data.
• Right to rectification (Article 16 GDPR) — You may request the correction of inaccurate personal data or the completion of incomplete data.
• Right to erasure (Article 17 GDPR) — You may request the deletion of your personal data where there is no legal obligation to retain it.
• Right to restriction of processing (Article 18 GDPR) — You may request that the processing of your data be restricted under certain circumstances.
• Right to data portability (Article 20 GDPR) — You may request to receive the personal data you provided in a structured, commonly used, and machine-readable format.
• Right to withdraw consent (Article 7(3) GDPR) — You may withdraw any consent given at any time with future effect. The lawfulness of processing carried out prior to withdrawal remains unaffected.
• Right to lodge a complaint (Article 77 GDPR) — You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority competent for Nephelix Nova Ltd. is the Office of the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, Malta — idpc.org.mt.

Visitors in the United Kingdom: where UK data protection law applies to the processing of your data, the information in this policy applies in the same way, and you may lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom — ico.org.uk.

12. Right to Object (Article 21 GDPR)

You may object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR. We will then stop processing that data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms. An informal email to jp@nephelix.com is enough.

13. Data Retention

• Server logs / Cloudflare: retained by Cloudflare under its own security log policies (typically a few days). We have no access to them and keep no logs of our own, so there is nothing on our side to delete.
• Aggregate usage data: retained by Cloudflare in aggregated form under its Web Analytics retention policy. It contains no identifier for you, so it cannot be traced back to an individual visitor or deleted per person.
• Email correspondence: for the duration of the business relationship and thereafter until the applicable tax and commercial retention periods expire (for Nephelix Nova Ltd., up to 10 years under Maltese law).
• Appointment bookings: where a booking does not lead to a business relationship, the calendar entry and the related confirmation and reminder emails are deleted six months after the appointment. Where it does, the periods for email correspondence apply. The call itself is not recorded, so nothing from it is retained.

14. Changes to This Policy

We reserve the right to update this privacy policy to reflect changes in our practices or for legal, regulatory, or operational reasons. The current version is always available on this page with the "Last updated" date above.