Privacy Policy

Nord CS GmbH, Rheinpromenade 11, 40789 Monheim am Rhein, Germany.

Privacy contact: contact@nordcs.de.

A data protection officer is not appointed, as the statutory thresholds of § 38 BDSG are not met.

CRA assessment tool: first name (optional), last name (optional), work email (required); your questionnaire answers about the product; any documents you choose to upload (optional); consent records (date/time and version of the Terms/Privacy text you accepted, and whether you opted in to the newsletter).

Contact form: first name, last name, work email (required); phone number, company name, job title, product interest, and your message (optional).

All visitors: technical data needed to operate the service securely — IP address (rate-limiting/anti-abuse), server log data (requested page, timestamp, browser/OS type), and basic attribution parameters (UTM/referrer). Cookie preferences are collected and stored via our consent-management solution.

To generate and email your assessment — on the basis of your consent (Art. 6(1)(a) GDPR), given via the required consent checkbox.

To answer your contact request — on the basis of pre-contractual measures and our legitimate interests in responding to enquiries (Art. 6(1)(b) and (f) GDPR).

To send you the optional newsletter — only if you separately opt in (Art. 6(1)(a) GDPR); you can withdraw at any time via the unsubscribe link in every email.

To keep the service secure and prevent abuse, and to measure the effectiveness of our outreach in aggregate — on the basis of our legitimate interests (Art. 6(1)(f) GDPR).

Cookies that are not strictly necessary are set only with your consent (Art. 6(1)(a) GDPR, § 25 TDDDG), which you can change at any time via "Cookie settings".

Hosting, storage, and email delivery: Amazon Web Services, with processing in the European Union (Frankfurt, Germany).

AI evaluation: your questionnaire answers and any uploaded documents are transmitted to Anthropic solely to generate your assessment. Anthropic acts as our processor under a data-processing agreement and does not use this data to train its models.

We do not sell your personal data.

Where Anthropic processes data outside the EU/EEA (United States), the transfer is protected by appropriate safeguards pursuant to Art. 46 GDPR (EU Standard Contractual Clauses); you may request further information about these safeguards via the contact in Section 8. AWS processing under this policy takes place in the EU region stated above.

Uploaded documents are deleted automatically after your assessment is generated, following a grace window of 30 days; abandoned drafts and their uploads are deleted on expiry after 14 days.

Your subscriber record (name, email, consent history, assessment result reference) is retained so we can evidence consent (Art. 7(1) GDPR) and provide the service, until you unsubscribe or request erasure.

Contact-form enquiries are deleted once the enquiry is resolved, unless statutory retention applies. Where data is subject to German statutory retention duties (e.g. §§ 147 AO, 257 HGB: six or ten years for business correspondence and accounting records), we retain it for those periods and restrict processing to that purpose.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future, without affecting prior processing.

You can unsubscribe from emails at any time using the one-click link in any email we send.

You have the right to lodge a complaint with a supervisory authority, in particular: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

For any privacy request: contact@nordcs.de, or by post to the controller address above.