Nopex.cloud
ende
Start free

Privacy Policy

Last updated: 2 November 2026

1. Privacy at a Glance

General Information

The following information provides a brief overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on the subject of data protection can be found in our privacy policy listed below this text.

Data Collection on This Website

Who is responsible for data collection on this website? Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information on the Responsible Party" in this privacy policy.

How do we collect your data? Your data is collected in part when you provide it to us, for example by sending us an email. There is no contact form on this website. Other data is collected automatically or with your consent when you visit the website by our IT systems. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for? Some of the data is collected to ensure error-free provision of the website. Beyond that, we analyse use of the website statistically and record which advertising campaign brought you here, so that it can be attributed to a later sign-up in the Nopex Console. We store that attribution in your browser beyond your visit only with your consent (for at most 90 days); without consent it travels in the page address for at most two hours (details in sections 5 and 6). With your consent we also recognise which companies visit our website (section 6, "Pipedrive Web Visitors").

What rights do you have regarding your data? You have the right to receive information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have a right of complaint to the competent supervisory authority.

2. Hosting

We host the contents of our website with the following provider:

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the host's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

External hosting is carried out for the purpose of fulfilling our contract with potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

3. General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Information on the Responsible Party

The responsible party for data processing on this website is:

Nopex GmbH
An der RaumFabrik 33c
76227 Karlsruhe
Germany

Phone: +49 721 619360-0
Email: [email protected]

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).

Storage Duration

Unless a more specific storage period has been specified within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a justified request for deletion or revoke consent for data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial retention periods); in the latter case, deletion will occur after these reasons no longer apply.

Legal Basis for Data Processing on This Website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data pursuant to Art. 9(1) GDPR are processed. In the case of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49(1)(a) GDPR.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent that has already been given at any time. The lawfulness of the data processing carried out up to the point of revocation remains unaffected by the revocation.

Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS.

Right to Lodge a Complaint with a Supervisory Authority

In the event of violations of the GDPR, data subjects have a right of complaint to a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement.

The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.

Access, Correction, and Deletion

Within the framework of applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing, and if applicable, a right to correction or deletion of this data.

4. Data Collection on This Website

Cookies

This website sets three cookies, for technical reasons:

Cookies set only after your consent

As long as you have not consented, the LinkedIn, Meta, Microsoft, OpenAI, Pipedrive Web Visitors (Leadfeeder), Reddit and TikTok scripts are not loaded and none of these cookies are set. Umami Analytics stores nothing on your device at all.

The Google script is the exception: it loads before you decide, but sets none of the cookies above until you consent (see "Google Analytics"). Without your consent, opening these pages establishes no connection to Leadfeeder's, LinkedIn's, Meta's, Microsoft's, OpenAI's, Reddit's or TikTok's servers.

Because the cookies "_ga", "_gcl_aw", "_fbp", "_fbc", "_ttp", "_rdt_uuid", "__obref" and "__oppref" are set on .nopex.cloud, the Nopex Console can read them too. It does so only if you have consented through the shared "nopex_consent" cookie (section 5), and uses them to attribute a sign-up to the advertising platform that brought you. See the Nopex Console's privacy notice for details.

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

This data is not merged with other data sources. The collection of this data is based on Art. 6(1)(f) GDPR.

Inquiries by Email or Phone

If you contact us by email or telephone, your inquiry, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.

5. Campaign Attribution and Your Consent

What we record, and why

When you reach this site from an advertisement, the address you open carries parameters naming the campaign (e.g. "utm_source", "utm_campaign") and a click identifier from the advertising platform (e.g. "fbclid", "ttclid", "gclid", "msclkid", "rdt_cid", "oppref"). We need these to tell which campaigns and which pages actually lead to sign-ups.

We record such a touch when you open this site with campaign parameters or arrive through a link on another website. For each touch we record:

We distinguish the first touch and the last touch: the first touch is recorded once and never changed afterwards; the last touch is replaced in full by every new touch. Reloading a page or moving back and forward does not count as a new touch.

Whether or not you arrive from an advertisement, and whether or not you consent, your browser also generates a random visit identifier ("nx_aid", 32 characters) when you open this site. It contains nothing about you and is not derived from your device. Its purpose is to connect your visit here with a subsequent sign-up in the Nopex Console. If you go on to the Nopex Console, we pass the visit identifier and the details of the last touch (or, failing that, the first) as parameters to the Console's address. If you go on to business.nopex.cloud without having consented, we pass the visit identifier and, while it is valid, the "nx_t" parameter described below; with your consent we append nothing, because business.nopex.cloud reads the shared "nopex_attr" cookie itself.

How long this data lasts depends on your choice.

With your consent: the "nopex_attr" cookie

With your consent, we store the visit identifier and the details of the first and the last touch in a cookie named "nopex_attr". It is set for .nopex.cloud and can therefore also be read by business.nopex.cloud and the Nopex Console (console.nopex.cloud). It is stored for 90 days from the first touch; later visits do not extend that period. This way the attribution survives if you leave and come back later. If you create an account in the Nopex Console, the Console reads the cookie and attributes the sign-up to the right campaign; what happens to the data there is described in the Nopex Console's privacy notice.

If you only consent part-way through your visit, we carry the data recorded up to that point (including the landing page) into the cookie.

The legal basis for storing this on your device is § 25(1) TDDDG together with your consent; for the subsequent processing, Art. 6(1)(a) GDPR.

Without consent, or after you decline: the "nx_t" address parameter

Without your consent we set no cookie and no entry in your browser's local storage for campaign attribution. The site works in full.

So that the attribution of your current visit is not lost at the first change of page or on reload, we append the parameter "nx_t" to the address in your browser's address bar as soon as a touch as described above exists, and carry it along as you move between pages of this site. This also applies if you chose "Decline" in the prompt. "nx_t" contains:

The data is merely re-encoded, not encrypted; anyone who has the address can read it. "nx_t" is valid for two hours from the first touch; after that we no longer evaluate it. If you go on to the Nopex Console or to business.nopex.cloud within that time, "nx_t" is passed along.

Please note: because the parameter is part of the address, it may remain in your browser history, in bookmarks and in links you copy or share. If someone opens such a link within the two hours, your touch details and your visit identifier are attributed to their visit. Remove the part starting with "nx_t=" before sharing a link if you want to avoid that.

If you arrive without campaign parameters and without a referring website, no "nx_t" is appended; the visit identifier then exists only in the memory of the open page, and a reload or a later visit generates a new one.

If you consent later, we move the data from "nx_t" into the "nopex_attr" cookie and remove the parameter from the address bar. "nx_t" never appears in canonical page addresses. We remove "nx_t" and "nx_aid" from the page addresses we pass to Google Analytics, Umami and the Meta Conversions API.

The legal basis for processing without consent is Art. 6(1)(f) GDPR. Our legitimate interest is being able to judge whether our advertising works even when visitors do not want anything stored on their device; we limit the intrusion to the data listed above and to two hours. You can object to this processing at any time under Art. 21 GDPR, for example by email to [email protected]; independently of that, you can remove the parameter from the address yourself at any time.

Your choice applies to www, business and the Console

On your first visit we ask once whether we may store the campaign attribution, load the advertising services listed under "Analytics and Advertising" and report enquiries, newsletter sign-ups, registrations and purchases to advertising providers with your email address as a hashed value; the latter does not happen on this website but on business.nopex.cloud and in the Nopex Console (section 6, "Hashed values"). We keep your answer in a cookie named "nopex_consent" (stored for 12 months) and additionally under the same key in your browser's local storage, so we do not have to ask again on every page and so our server can honour your decision too. The cookie applies to .nopex.cloud and is therefore sent to every address under that domain. This website, our company website business.nopex.cloud and the Nopex Console (console.nopex.cloud) use the same cookie: a decision you make or change in any of these places applies in the others as well, without asking you again. If you are signed in to the Nopex Console, the Console also stores your decision in your account; see its privacy notice for details. Storing your decision is exempt from consent under § 25(2) TDDDG because it serves only to carry out your decision.

Together with your decision we store, in the cookie "nopex_consent_text", which version of the consent text you made it under. The November 2026 version is the first to name the transmission of your email address as a hashed value. If you consented under an earlier version, that consent remains valid for everything else and we do not ask you again on this website; we do not, however, transmit hashed values on the basis of it.

You can withdraw your consent at any time with effect for the future. Use the "Cookie settings" link in the footer of every page of this site, including our campaign pages: it reopens the prompt, where you choose "Decline". Alternatively, clear this site's data in your browser settings. On withdrawal we delete the "nopex_attr" cookie immediately, discard the visit identifier and touch details recorded so far, generate a new visit identifier and remove any "nx_t" parameter from the address bar. Because the "nopex_consent" cookie is shared, the withdrawal also takes effect on business.nopex.cloud and in the Nopex Console.

6. Analytics and Advertising

Umami Analytics

We use Umami Analytics, a privacy-friendly website analytics service provided by Umami Software, Inc. Umami sets no cookies and stores nothing on your device. It collects page-view statistics (e.g. pages visited, time on page, referring website, device type). Every change of page within this site is counted, including those that do not fully reload the page. IP addresses are not stored and no cross-device tracking takes place. We remove the parameters "nx_t" and "nx_aid" from the page addresses sent to Umami.

In addition, on every visit we pass Umami the random visit identifier described in section 5 — whether or not you have consented — so that your page views here and a subsequent sign-up in the Nopex Console can be evaluated as one journey. On its own, the identifier reveals nothing about you. If you withdraw your consent, Umami receives a new identifier from that point on.

The data is processed on Umami's servers (cloud.umami.is). Because Umami neither stores nor reads anything on your device, no consent is required under Art. 5(3) of the ePrivacy Directive or § 25(1) TDDDG. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in statistical analysis of website use). More information: https://umami.is/privacy

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The script is loaded from www.googletagmanager.com before you make a choice in the cookie banner. It then runs in what Google calls Consent Mode: until you consent, Google is denied any storage on your device at all — every category, including the ones for security and for preferences. No cookie is set and no identifier is stored. In that state Google receives a cookieless signal that a page was opened. What such a signal typically contains: your IP address, the address and title of the page, the address of the page you came from, your browser identification (user agent), language setting and screen size. If you arrived through an ad, the address may contain a click identifier such as gclid. We remove the parameters "nx_t" and "nx_aid" (section 5) from the page address before it is sent. What we can promise is what we control: in this state no cookie is set and no identifier that would make you recognisable across visits is stored on your device. The legal basis for this transmission is Art. 6(1)(f) GDPR — our legitimate interest in being able to judge whether our advertising works at all. We should say plainly that whether loading such a script without consent is permissible is disputed among supervisory authorities: § 25(1) TDDDG requires consent not only for storing information on your device but also for accessing information already there, and it is unsettled whether a script reading browser and device characteristics falls under that.

You can object to this processing at any time, most simply by choosing "Decline" in the prompt. We treat that explicitly as an objection under Art. 21 GDPR: after a refusal, every further page you open carries no Google script at all — it is not even in the served page source. On the page where you refuse, a script already loaded cannot technically be removed; it is instructed at that moment to store nothing, and it is gone with your next page view.

If you decline, the transmission described above stops and the script is no longer embedded at all. Once you consent, this website permits Google to store: From that point cookies are set to analyse your use of this website (e.g. pages visited, time on page, referrer). If you withdraw your consent, Google is immediately returned to the non-storing state.

The information generated is transmitted to Google's servers, including in the USA, and stored there. Transfers to the USA rely on the EU standard contractual clauses and the EU-US Data Privacy Framework.

The purpose is statistical analysis of website use to optimise our offering. For storage on your device and the analysis that follows, the legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); for the cookieless signal sent while you have not yet decided, our legitimate interest (Art. 6(1)(f) GDPR) — with the reservation and the right to object stated above. More information: https://policies.google.com/privacy

Google Ads

This website uses Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is embedded via the same script as Google Analytics (www.googletagmanager.com) and is subject to the same Consent Mode and the same refusal rule: without your consent, no cookies and no identifiers, only a cookieless signal that a page was opened — and after a refusal, not even that. For the requests to Google Ads we instruct Google to strip advertising identifiers from the address it receives while you have not consented (ads_data_redaction). That covers the advertising requests; the Google Analytics measurement described above is not included.

Once you consent, the script measures page views on this website and lets us evaluate our Google Ads campaigns against those visits and build advertising audiences. Google sets a cookie for this. This website does not link an individual click (e.g. on "Start free") to a specific ad; where we define conversion actions for Google Ads, that happens entirely within our Google Ads account, not through additional code on this page.

This does not contradict the paragraph above: that one is about what Google receives in its advertising requests, this one about what stands in your address bar. While you have not consented, the script may carry advertising identifiers from the ad URL (e.g. gclid) along in the address bar as you move between pages of this website, rather than storing them in a cookie (url_passthrough). Nothing is stored on your device in the process.

This website does not add a Google identifying parameter when you move to our console (console.nopex.cloud); no Google script runs there. We follow that transition in two ways: through the attribution described in section 5 ("nopex_attr" or "nx_t"), which we keep ourselves, and — only once you have consented — through the Google cookies "_ga" and "_gcl_aw", which are set on .nopex.cloud and can therefore be read on the console as well.

The purpose is measuring and optimising our advertising campaigns on Google Ads. For storage on your device and the analysis that follows, the legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); for the cookieless signal sent while you have not yet decided, our legitimate interest (Art. 6(1)(f) GDPR) — with the reservation and the right to object stated above. More information: https://policies.google.com/privacy

LinkedIn Insight Tag

This website uses the LinkedIn Insight Tag, a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The Insight Tag is loaded only after your explicit consent; without it the script is never embedded.

Once you consent, the script is loaded from snap.licdn.com. It measures page views on this website and lets us evaluate our LinkedIn campaigns against those visits and build advertising audiences ("retargeting"). In doing so it can transmit your IP address, your user agent, and the URL you opened to LinkedIn. Transfers to third countries, including the USA, rely on the EU standard contractual clauses.

For the collection of data on this website by the Insight Tag and its transmission to LinkedIn, we and LinkedIn are joint controllers (Art. 26 GDPR), under the agreement that forms part of LinkedIn's advertising terms. We obtain your consent and inform you about the processing; LinkedIn is solely responsible for the processing after the transmission and, to that extent, also handles your rights as a data subject. You can exercise your rights against us as well as against LinkedIn (Art. 26(3) GDPR). Under its terms, LinkedIn also uses the data for its own purposes and determines itself how long it keeps it.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). More information: https://www.linkedin.com/legal/privacy-policy

Meta Pixel

This website uses the Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The pixel is loaded only after your explicit consent; without it the script is never embedded, so no connection to Meta is made at all.

Meta Pixel (browser side). Once you consent, the script is loaded from connect.facebook.net and sets the cookies "_fbp" and "_fbc" (stored for up to 90 days). It records the page view and the click on "Start free" that takes you to the Nopex Console.

Meta Conversions API (server side). The click on "Start free" is additionally sent to Meta through our server, so the measurement also works when an ad blocker is active. The browser event and the server event share one event ID so Meta can recognise duplicates. We transmit: your IP address and your user agent — both in plain text, as Meta does not accept hashed values for these —, the values of the "_fbp" and "_fbc" cookies, and the URL (without the parameters "nx_t" and "nx_aid") and time of the event. This transmission, too, happens only after your consent; our server checks the "nopex_consent" entry before passing anything on.

We do not use the automatic detection of contact details on the page ("Automatic Advanced Matching"). This website sends Meta neither your email address nor your name, not even as a hashed value (see "Hashed values").

The purpose is measuring and optimising our advertising campaigns on Meta platforms. The recipient is Meta Platforms Ireland Limited; transfers to Meta Platforms, Inc. in the USA rely on the EU-US Data Privacy Framework and EU standard contractual clauses.

For the collection of data on this website by the pixel and the Conversions API and for its transmission to Meta, we and Meta are joint controllers (Art. 26 GDPR). Under the agreement concluded for this, we obtain your consent and inform you about the processing; Meta is solely responsible for the processing after the transmission and, to that extent, also handles your rights as a data subject. You can exercise your rights against us as well as against Meta (Art. 26(3) GDPR). The agreement is available at https://www.facebook.com/legal/controller_addendum. Under its terms, Meta also uses the data for its own purposes and determines itself how long it keeps it. More information: https://www.facebook.com/privacy/policy

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Microsoft Advertising (UET tag)

This website uses Universal Event Tracking (UET) from Microsoft Advertising, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The script is loaded only after your explicit consent; without it the script is never embedded, so no connection to Microsoft is made at all.

Once you consent, the script is loaded from bat.bing.com. It measures page views on this website and lets us evaluate our Microsoft Advertising campaigns (ads in Bing and the Microsoft advertising network) against those visits and build advertising audiences. For this it sets the cookies "_uetsid" (stored for 1 day), "_uetvid" (stored for up to 13 months) and, if you arrived from a Microsoft ad, "_uetmsclkid" (that ad's click identifier, stored for up to 90 days), and keeps the same entries, each with a companion entry "…_exp", in your browser's local storage (localStorage) as well; Microsoft may also set or read the cookie "MUID" on its own domains (stored for up to 13 months), with which Microsoft recognises your browser across its services. In doing so it transmits in particular your IP address, your user agent, the URL you opened, the referring page and the identifiers named above to Microsoft. This website sends no event for the click on "Start free" to Microsoft; attributing a sign-up to a Microsoft ad (using the click identifier "msclkid") is done by the Nopex Console and described in its privacy notice.

The purpose is measuring and optimising our advertising campaigns on Microsoft Advertising. Transfers to Microsoft Corporation in the USA rely on the EU-US Data Privacy Framework, under which Microsoft Corporation is certified, and on EU standard contractual clauses. Microsoft determines how long it keeps the data and what it also uses it for itself under its terms. More information: https://privacy.microsoft.com/en-gb/privacystatement

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

OpenAI Ads

This website uses the OpenAI Ads Measurement Pixel and Conversions API to measure how our ads in ChatGPT perform. The recipient of the data and our contracting party for OpenAI Ads is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Data may also be transferred to its affiliate OpenAI OpCo, LLC, 1455 Third Street, San Francisco, CA 94158, USA. The pixel is loaded only after your explicit consent; without it the script is never embedded, so no connection to OpenAI is made at all.

OpenAI Measurement Pixel (browser side). Once you consent, the script is loaded from bzrcdn.openai.com; it sends its measurements to bzr.openai.com. It sets the cookies "__obref" (a random identifier for your browser, stored for 12 months) and, if you arrived from an ad in ChatGPT, "__oppref" (that ad's click identifier from the "oppref" address parameter, stored for 30 days and renewed on every further ad click), both on .nopex.cloud. If the click identifier is no longer in the address – for example because you had already left the page before consenting – and the pixel has not stored it yet, we give it to the pixel from the stored campaign data ("nopex_attr"), provided the ad click was no more than 30 days ago. The pixel then stores it for 30 days itself. It also creates an entry "oaiq_cs:…" in your browser's session storage (sessionStorage), which is deleted when you close the browser tab, and briefly sets a test cookie "__oaiq_domain_probe" (stored for 60 seconds) to find the right domain. It records the page views on this website, including moves between pages, and the click on "Start free" that takes you to the Nopex Console. In doing so it transmits in particular your IP address, your user agent, the page you opened (without address parameters), the page you came from and the identifiers named above to OpenAI. We do not use the automatic detection of contact details on the page ("Automatic Advanced Matching").

OpenAI Conversions API (server side). The click on "Start free" is additionally sent to OpenAI through our server, so the measurement also works when an ad blocker is active. The browser event and the server event share one event ID so OpenAI can recognise duplicates. We transmit: your IP address and your user agent in plain text, the value of the "__obref" cookie, the click identifier "oppref" (from the data stored under "nopex_attr" or the "__oppref" cookie), and the page and time of the event. This transmission, too, happens only after your consent; our server checks the "nopex_consent" entry before passing anything on.

The purpose is measuring and optimising our advertising campaigns in ChatGPT. Under its contract terms, OpenAI uses this data not only to report the performance of our ads to us but also, as an independent controller, to attribute ad clicks in ChatGPT, to build audiences for ad campaigns, to optimise ad delivery and to develop and improve its own products and services. According to OpenAI, it does not currently use this data to personalise ads for individual users. We have no influence over OpenAI's processing.

For the collection of data by the pixel on this website and its transmission to OpenAI, we and OpenAI are joint controllers under the case law of the CJEU (judgment of 29 July 2019, C-40/17 – Fashion ID) (Art. 26 GDPR). OpenAI classifies itself as an independent controller in its contract terms. You can exercise your rights (section 3) against us as well as against OpenAI; we obtain your consent and give effect to your withdrawal. For events transmitted through our server (Conversions API) and for any further processing once the data has reached OpenAI, we and OpenAI are each independent controllers.

Where personal data is transferred to the USA in the process, in particular to OpenAI OpCo, LLC, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module One), which form part of OpenAI's data processing terms for ad tools. OpenAI determines how long it keeps the data; its ad tools terms do not state a specific period. More information: https://openai.com/policies/eu-privacy-policy/ and https://openai.com/policies/ad-tools-dpa/

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Pipedrive Web Visitors (Leadfeeder)

This website uses Pipedrive Web Visitors, an add-on to our CRM system Pipedrive that shows us which companies visit our website. The service is delivered by Leadfeeder; the provider is Dealfront Group GmbH (doing business as Leadfeeder Group), Durlacher Allee 73, 76131 Karlsruhe, Germany. The script is loaded only after your explicit consent; without it the script is never embedded, so no connection to Leadfeeder is made at all.

Once you consent, the script is loaded from sc.lfeeder.com and reports your visits to tr.lfeeder.com. It records the page views on this website, including moves between pages, their time and duration, and the referring website. In doing so it transmits in particular your IP address, your user agent, the URL and title of the page you opened, the referring page and the identifier from the "_lfa" cookie. If Google Analytics is active with your consent, the script also reads the identifier from Google's "_ga" cookie and the ids of our Google data streams and sends them along. The "_lfa" cookie (a random identifier for your browser, stored for 12 months) is set on .nopex.cloud and also kept, with its expiry ("_lfa_expiry"), in local storage (localStorage); it serves to recognise repeat visits from the same browser. Because it applies to .nopex.cloud, your browser also sends it to our other addresses under that domain.

Leadfeeder uses the IP address to attribute a visit to the company whose network it comes from; according to Pipedrive, visits from residential internet connections are filtered out. We see the companies recognised this way, and their page views, in our Pipedrive account and use them for our sales work. Pipedrive is our CRM provider here: Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia.

Pipedrive processes the data on our behalf; we have concluded a data processing agreement with Pipedrive pursuant to Art. 28 GDPR. Leadfeeder acts as a sub-processor of Pipedrive and, by its own account, processes the data on servers in the European Union; where data is transferred to third countries, this relies on EU standard contractual clauses. More information: https://www.leadfeeder.com/privacy-notice/ and https://www.pipedrive.com/en/privacy

The purpose is recognising which companies are interested in what we offer, so that we can approach them. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Reddit Pixel

This website uses the Reddit Pixel. For users in the European Economic Area the provider is Reddit Netherlands B.V.; data is also transferred to Reddit, Inc., San Francisco, USA. The pixel is loaded only after your explicit consent; without it the script is never embedded, so no connection to Reddit is made at all.

Reddit Pixel (browser side). Once you consent, the script is loaded from www.redditstatic.com and sets the cookies "_rdt_uuid" (a random identifier for your browser) and, if you arrived from a Reddit ad, "_rdt_cid" (that ad's click identifier), each stored for 90 days. It also creates the entry "_rdt_cfg" in your browser's session storage (sessionStorage), which is deleted when you close the browser tab. It records the page views on this website, including moves between pages, and the click on "Start free" that takes you to the Nopex Console. In doing so it transmits in particular your IP address, your user agent, the URL you opened and the identifiers named above to Reddit.

Reddit Conversions API (server side). The click on "Start free" is additionally sent to Reddit through our server, so the measurement also works when an ad blocker is active. The browser event and the server event share one event ID so Reddit can recognise duplicates. We transmit: your IP address and your user agent in plain text, the value of the "_rdt_uuid" cookie, the click identifier "rdt_cid" (from the data stored under "nopex_attr", which hold the identifier of the most recent Reddit ad click recorded, or, if there is none there, from the "_rdt_cid" cookie), and the URL and time of the event. This transmission, too, happens only after your consent; our server checks the "nopex_consent" entry before passing anything on.

The purpose is measuring and optimising our advertising campaigns on Reddit. Reddit and we are each independent controllers for this event data. Transfers to Reddit, Inc. in the USA rely on the EU-US Data Privacy Framework, under which Reddit, Inc. is certified, and alternatively on EU standard contractual clauses. Reddit determines how long it keeps the data and what it also uses it for itself under its terms. More information: https://www.reddit.com/policies/privacy-policy

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

TikTok Pixel

This website uses the TikTok Pixel. For users in the European Economic Area the provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. This pixel, too, is loaded only after your explicit consent.

Once you consent, the script is loaded from analytics.tiktok.com. It records the page view and the click on "Start free". In doing so it processes in particular your IP address, your user agent, the URL you opened and an identifier assigned by TikTok. We do not use the automatic detection of contact details on the page ("Automatic Advanced Matching").

The purpose is measuring and optimising our advertising campaigns on TikTok. For the collection of data on this website by the pixel and its transmission to TikTok, we and TikTok are joint controllers (Art. 26 GDPR), under the agreement that forms part of TikTok's advertising terms. We obtain your consent and inform you about the processing; TikTok is solely responsible for the processing after the transmission and, to that extent, also handles your rights as a data subject. You can exercise your rights against us as well as against TikTok (Art. 26(3) GDPR). Under its terms, TikTok also uses the data for its own purposes and determines itself how long it keeps it.

Transfers to third countries, including the USA and Singapore, rely on EU standard contractual clauses; according to TikTok, access from further third countries, including China, is possible. More information: https://www.tiktok.com/legal/page/eea/privacy-policy/en

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Hashed values

This website itself does not send your email address, your name or a user identifier to any advertising provider, not even as a hashed value; there is no form and no account here. Your decision in the consent prompt, however, also applies to our company website business.nopex.cloud and the Nopex Console (section 5). There, to measure our advertising, we send your email address (for enquiries additionally your first and last name to Meta; from the Console additionally a user identifier we assign) to some of the advertising providers named in the consent prompt (Meta, TikTok, LinkedIn, Reddit, OpenAI, Google Ads and Microsoft Advertising) when you make an enquiry or sign up for the newsletter (business.nopex.cloud) and when you register or make a purchase in your projects (Nopex Console) — not in plain text but as a hashed value (SHA-256). A hashed value is a string calculated from these details. The provider can match it against the hashed values of the accounts it holds and so determine whether you have an account there and have seen or clicked one of our ads. Hashed values are pseudonymised data and remain personal data. We transmit them only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future through the cookie settings, and only if you gave it under a version of the consent text that names this transmission (section 5). Which provider receives which details is described in the privacy policy of business.nopex.cloud and in the Nopex Console's privacy notice.

Withdrawal

You can withdraw your consent at any time with effect for the future: use the "Cookie settings" link in the footer of every page, including our campaign pages, and choose "Decline" in the prompt. Through the shared "nopex_consent" cookie, the withdrawal also applies on business.nopex.cloud and in the Nopex Console (section 5); from then on, no hashed values are transmitted there either. After withdrawal the Google, LinkedIn, Meta, Microsoft, OpenAI, Pipedrive Web Visitors, Reddit and TikTok scripts are no longer loaded. Because a script once loaded cannot be removed from memory afterwards, a Google script already loaded is additionally returned to its non-storing state straight away, a Reddit Pixel already loaded deletes its "_rdt_uuid" and "_rdt_cid" cookies straight away and sets no new ones, an OpenAI pixel already loaded is told through its own consent switch to send nothing more, and the "__oppref" and "__obref" cookies are deleted even where the pixel is not loaded on the current page (what remains is the "__oaiq_consent" cookie with the value "false", which holds no identifier, see "Cookies"); measurements the pixel had already collected but not yet sent may still go out in one final transmission when you withdraw and cannot be recalled, the Microsoft entries "_uetsid", "_uetvid" and "_uetmsclkid" are deleted, both as cookies and from local storage (including the "…_exp" companion entries), and a Pipedrive Web Visitors tracker already loaded is told through its own off-switch to send nothing more, including on moves between pages; the "_lfa" cookie and the "_lfa" and "_lfa_expiry" entries in local storage are deleted. What remains is the "ldfdr_opt_out" cookie, which holds no identifier (see "Cookies") and which we remove if you consent again. A page view the tracker already reported before your withdrawal cannot be recalled. The "MUID" cookie lives on Microsoft's domains and cannot be deleted by us. Any other cookies those providers already set can be removed in your browser settings.

7. Fonts

Google Fonts (Local Hosting)

This site uses Google Fonts for a consistent display of typefaces, provided by Google. The Google Fonts are installed locally. No connection to Google servers is made.

8. Other Nopex Services

The Nopex Console at console.nopex.cloud and our company website at business.nopex.cloud have their own privacy notices. Following a link from this site to either of them takes you outside the scope of this policy. The campaign attribution data described in section 5 and your decision in the consent prompt are passed to, or read by, these services as described there.