Privacy
What this website processes, why, on what legal basis, and for how long. Client systems are covered separately on Where your data goes →; this page is about the website only.
Last updated: 6 October 2026.
The short version
This site is static. It sets no cookies and carries no third-party analytics or advertising trackers, so there is no consent banner. If you use the light or dark switch in the header, your browser remembers your choice on your device; it is never sent to us. Server logs are kept briefly, with shortened IP addresses, to keep the site available and secure. If you book a call or ask for a checklist or the digest, the data you enter goes to the European providers named below, some of which use sub-processors outside the EU (see "Who processes data for us").
Controller
Nova Mobility Consulting, Raphael Santos Cavalcanti, An den Grachten 5, 55120 Mainz, Germany. E-mail: contact@nova-mobility.com.
We have not appointed a data protection officer. The thresholds that would require one — § 38 Abs. 1 BDSG (at least twenty people regularly processing personal data) and Art. 37 (1) GDPR — are not met. Data protection enquiries go to the address above.
Your rights
You have the right to obtain information about the data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or restricted (Art. 18), to object to processing based on our legitimate interests (Art. 21), and to receive data you gave us in a portable form (Art. 20). Where processing rests on your consent, you can withdraw it at any time; that does not affect what was lawful before the withdrawal.
You can also complain to a supervisory authority. Ours is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Postfach 30 40, 55020 Mainz · Hintere Bleiche 34, 55116 Mainz
+49 6131 8920-0 · poststelle@datenschutz.rlp.de · datenschutz.rlp.de
You may also complain to the authority where you live or work.
What we process, and why
Visiting the site
Our hosting provider records each request in a server log: the shortened IP address, the page requested, the date and time, the referring page, and your browser and operating system. We use this to deliver the site, to keep it available and to recognise attacks. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and functioning site. Logs are deleted after seven days, except where an entry is needed as evidence of a specific security incident, in which case it is kept until that incident is resolved.
Booking a call
The booking form (Tally) asks for the type of organisation you work for, your role, your first and last name, your work e-mail address, the process or question that brings you here and, optionally, what it costs you if it stays unsolved for twelve months. The calendar (meetergo) then asks you to pick a time; your name and e-mail address are prefilled from the form. We use this to prepare and hold the call. Legal basis: Art. 6 (1) (b) GDPR for steps taken at your request before a contract, and Art. 6 (1) (f) for general enquiries. Providing the data is not a statutory requirement, but without it we cannot arrange the call. We keep the answers while we are in contact and for up to three years from the end of the year of your enquiry, which is the ordinary limitation period under §§ 195, 199 BGB. Where an invoice follows, tax law requires longer retention: eight years for accounting vouchers under § 147 AO and § 257 HGB, ten years for the documents that provision covers.
Documents you send us before a call
If you send a document for us to look at, it stays with us, it is not used to train any model, and it is deleted after the call unless you ask us to keep it. Legal basis: Art. 6 (1) (b) and (f) GDPR.
The checklist and the tender digest
To send you the pilot-to-production checklist or the weekly digest we need your e-mail address. You confirm the subscription by clicking a link in a confirmation e-mail, and we record that confirmation — the time and the confirming request — as proof that you consented. Apart from your confirmation, Brevo is set not to record whether individual recipients open our e-mails or click their links. Links in the e-mails pass through a Brevo redirect, which Brevo uses to protect its sending platform against abuse. Legal basis: Art. 6 (1) (a) GDPR, and § 7 Abs. 2 Nr. 2 UWG for the e-mails themselves; the record of your confirmation rests on Art. 6 (1) (c) and (f), since we have to be able to demonstrate consent under Art. 7 (1) GDPR. We keep your address on the mailing list until you unsubscribe. Every e-mail carries an unsubscribe link. After you unsubscribe we keep your address on a suppression list so that you are not added again by mistake; that residual processing rests on Art. 6 (1) (f).
Writing to us
If you e-mail us, we process what you write in order to answer. Our e-mail runs on Google Workspace (see "Who processes data for us"). Legal basis: Art. 6 (1) (b) or (f) GDPR. We keep the correspondence as described under "Booking a call".
No cookies, no tracking
We set no cookies. The only thing this site stores in your browser is your light or dark choice, and only if you use the switch in the header: one entry ("nm-theme") in your browser's local storage that stays on your device and is never sent to us. You can delete it at any time in your browser settings. It is strictly necessary for the function you asked for, so § 25 Abs. 2 Nr. 2 TDDDG applies, not the consent requirement of § 25 Abs. 1 TDDDG, and the site shows no consent banner. There is no analytics service, no advertising network, no social-media plugin and no embedded font: the fonts are served from our own domain.
Who processes data for us
Each of these companies acts on our instructions under a processing agreement (Art. 28 GDPR).
| Provider | What it handles | Where |
|---|---|---|
| BunnyWay d.o.o. (bunny.net) | Hosting, CDN and DNS: serving the site, server logs | Slovenia; edge storage in Frankfurt, Germany, replicated to Stockholm, Sweden |
| Tally BV | The form on the booking page | Belgium |
| meetergo GmbH | Calendar and appointment booking | Germany (Monheim am Rhein); primary hosting in the European Economic Area |
| Sendinblue SAS (Brevo) | Sending the checklist and the digest | France |
| Google Cloud EMEA Limited (Google Workspace) | Our e-mail, including contact@nova-mobility.com | Ireland; data may be processed in Google data centres outside the EU, including the United States |
Our source code is kept at GitHub (United States). No visitor data reaches it: the site is built and served from the providers above.
Some of these providers use sub-processors outside the EU. Brevo states that it transfers data, in particular to the United States and to India. meetergo states that it transfers data to the United States through its sub-processors Twilio, PostHog and Stripe. Google may process e-mail in the United States; Google LLC is certified under the EU-US Data Privacy Framework. Transfers to the United States rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework of 10 July 2023 where the recipient is certified under it, and otherwise on the standard contractual clauses adopted by the Commission on 4 June 2021. There is no adequacy decision for India; that transfer rests on the standard contractual clauses. You can ask us for a copy of the safeguards at contact@nova-mobility.com, and we will send it.
Automated decisions
We make no automated decisions about you within the meaning of Art. 22 GDPR, and we do not profile you.
Changes
We update this page when the site changes. The date at the top says when it last changed.