As of September 14, 2026
This data protection declaration explains how personal data is processed when you visit nosa-partners.com and when you contact us via the methods indicated on the website. Personal data is information that can be used to identify an individual.
1. Controller and contact
NOSA Partners GbR
represented by managing partner Noah Shawn Watling
Wibiloweg 16
69123 Heidelberg
Germany
Email: team@nosa-partners.com
If you have any questions about data protection or exercising your rights, you can contact us using these contact details.
2. What data is generated when you visit the website
When you access our website, your browser transmits technically necessary information to the servers that provide our website and its files. This includes in particular the IP address, date and time, requested address and file, HTTP status, amount of data transferred as well as the device, browser and operating system information transmitted by the browser. Depending on the browser settings, the previously visited page or its origin (referrer) can also be transmitted.
This processing serves the delivery of the website, its stability, error analysis and protection against misuse and attacks. The legal basis is Article 6 Paragraph 1 Letter f GDPR. Our legitimate interest is the safe and reliable operation of our internet offering. The website cannot be made available without the technically necessary transmission.
3. Hosting and delivery via Vercel
We use Vercel Pro from Vercel Inc., USA, to host and deliver our website via a content delivery network. Vercel receives the technical data described in Section 2. Access and technical events can be logged for deployment, troubleshooting and security. Processing can take place on servers distributed around the world, including outside the EU or EEA.
The storage period for technical logs depends on their operational and security purpose as well as the storage and deletion rules applicable to the hosting provider. Data on specific security incidents may be required for longer to clarify and enforce or defend claims. You can find information about processing by Vercel in the Vercel privacy policy and the Data Processing Terms.
4. Technical libraries, fonts and external file servers
On the main page and several subpages, technical files are loaded directly from external servers. This affects Webflow runtime files, GSAP and ScrollTrigger via cdn.prod.website-files.com, jQuery via d3e54v103j8qbb.cloudfront.net and Finsweet Attributes via cdn.jsdelivr.net. Some subpages also refer to font files on Webflow.
When accessed, the respective providers and their infrastructure partners receive in particular the IP address, the requested file, the time of retrieval and the browser and referrer information sent along with it. The integrations serve the presentation, animation and usability of the website. The legal basis for the interest in a functional and consistent website is Article 6 (1) (f) GDPR. The files can be cached in the browser.
Recipients are in particular Webflow Inc. and its delivery infrastructure, Amazon Web Services for CloudFront delivery as well as jsDelivr and its CDN partners. Information on their processing and storage: Webflow, AWS and jsDelivr. These connections may involve processing outside the EU or EEA.
5. Cookies, browser storage and audience measurement
There are no marketing pixels from Meta or TikTok, no Google Analytics and no Google Tag Manager integrated into the current website code. We do not use our own analysis or advertising cookies on this website. The display of partner logos alone does not constitute integration of the tracking services of these providers.
Image changes, video control and the selection of an ad example are controlled by the website in the browser. The selected case study may be visible as a parameter in the page address. These features are not a login and do not create a permanent visitor profile in the website code. Technical browser caching is used to load the files.
In order to store information on your device or access it, consent is generally required in accordance with Section 25 Paragraph 1 TDDDG. The exceptions to Section 25 Paragraph 2 TDDDG particularly concern processes that are absolutely necessary for the transmission of a message or the provision of an expressly requested digital service. A data protection declaration does not replace the necessary consent. You can delete or restrict cookies and stored website data through your browser settings.
6. Images, videos and ad examples
The ad images and videos shown on this website are delivered as files via our website hosting. Simply viewing or playing the locally integrated examples does not open any embedded player from YouTube, Vimeo, Instagram or Facebook. The associated technical retrieval data is processed as described in Sections 2 and 3.
The content may contain names, publicly displayed people, trademarks and advertising statements. They are used to present advertising design and, according to their labeling, external advertising examples. If you are affected by your own data protection rights with regard to the content displayed, you can contact us using the contact details mentioned above.
7. Contact and appointment scheduling via email
The contact and getting to know channels currently lead to email communication. Clicking on an email link opens your email program; he is not sending a message yet. An external booking calendar or a contact form is not embedded in the current website.
If you write to us, we process your email address, if applicable your name and contact details as well as the message content, attachments and communication metadata. The purpose is to process your request, coordinate appointments and, if necessary, prepare or carry out a collaboration. The recipients are the people entrusted with processing as well as the email and IT service providers used.
For contract-related inquiries, Art. 6 Para. 1 lit. b GDPR applies, for other inquiries Art. 6 Para. 1 lit. f GDPR applies due to our interest in answering concerns addressed to us. Legally required storage is based on Article 6 Paragraph 1 Letter c GDPR. The information is voluntary; Without sufficient information and a means of contact, we may not be able to process your request. Please do not send particularly confidential information unprotected via email.
Managing requests with GoHighLevel
We use GoHighLevel from HighLevel, Inc., USA, to manage inquiries and customer contacts. Depending on the content of your request, we process names, email addresses, telephone numbers, company details, messages, appointments and processing notes. The processing serves to answer and follow up on your request and to organize our collaboration. The legal bases mentioned above apply to contract-related and other inquiries. Use for advertising requiring consent requires separate consent.
HighLevel processes this customer data as a processor. That included in the terms of the contract Data Processing Addendum regulates this processing and contains EU standard contractual clauses for covered third country transfers, unless a priority adequacy decision applies. Data can be processed in particular in the USA. HighLevel uses other service providers, see Subprocessors. Simply visiting our website does not currently load a GoHighLevel form or calendar. Section 9 applies to the storage and deletion of requests.
8. Applications
You can submit an unsolicited application by email via our careers page. In particular, contact details, qualifications, CV, work samples and your other application communication are processed to the extent that they are necessary for the decision to establish an employment relationship. The legal basis is Section 26 Paragraph 1 BDSG; to the extent relevant, in addition to Article 6 Paragraph 1 Letter b GDPR.
The people involved in the personnel decision as well as technical service providers for email and IT require access. Any inclusion in an applicant pool beyond this requires a separate basis, such as your voluntary consent in accordance with Article 6 (1) (a) GDPR. You can revoke such consent in the future.
9. Storage period and deletion
We delete inquiries as soon as they have been processed and there are no legal retention obligations or legitimate reasons for further storage. This rule applies to request management in GoHighLevel and associated email communication. If further storage is necessary, we limit the processing to the respective storage purpose.
The decisive factors for the duration of storage are the respective processing purpose, the end of processing, legal retention obligations and the necessity to enforce or defend against legal claims. A request without a subsequent contract does not require the same retention as business records that require retention. Data that is only retained due to a legal obligation may not be used for any other purposes.
The completion of the application process and possible deadlines for asserting claims are decisive for application documents. When you are hired, the necessary documents can be transferred to human resources administration. Any further storage for later purposes requires a separate legal basis. You can request information about the storage periods applied to your data and deletion in accordance with the legal requirements.
10. Recipients and transfers to third countries
In addition to the providers expressly mentioned, service providers for hosting, email, IT operations and security can be considered as recipients. Disclosures required by law may be made to relevant authorities; If necessary, in individual cases, consultants who are professionally sworn to secrecy can be involved in the legal prosecution.
For transfers outside the EU and the EEA, the requirements of Art. 44 ff. GDPR also apply. In particular, a relevant adequacy decision or suitable guarantees such as EU standard contractual clauses and necessary supplementary measures come into consideration. The EU-US Data Privacy Framework only covers appropriately certified US recipients and the processing covered by the certificate. You can request information about the guarantees used for a specific transmission or a copy via our data protection contact.
11. Your rights
In accordance with the legal requirements, you have the right to information (Article 15 GDPR), correction (Article 16), deletion (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can revoke your consent at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected.
Contradiction: If the processing is based on Article 6 (1) (e) or (f) of the GDPR, you can object to this for reasons arising from your particular situation in accordance with Article 21 of the GDPR. When processing for direct advertising, you can object at any time without giving any special reasons; this also applies to associated profiling.
You also have the right to complain to a data protection supervisory authority, in particular at your usual place of residence, your place of work or the location of a suspected violation. The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg is responsible for our headquarters. Contact and complaint options.
12. External links and changes
Links to social networks, the Meta Ad Library and other third-party websites lead to offers with their own data protection conditions. Only when you follow such a link will you access the linked offer. The technical file integrations explained above are to be distinguished from this because they are already loaded when the page is accessed.
This statement describes the stated website status. New forms, calendars, analysis or advertising services require a new check and, if necessary, an adjustment of the declaration and consent controls.