Privacy policy

1. Data protection at a glance

General information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to our privacy policy set out below this text.

Data collection on this website

Who is responsible for collecting data on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

How do we collect your data?

Your data is collected in part because you provide it to us. This may be data you enter into a contact form or supply when registering.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (such as your browser, operating system or the time of the page request).

What do we use your data for?

Some of the data is collected to ensure that the website works without errors. Other data may be used to analyse how you use the site.

What rights do you have regarding your data?

You have the right at any time to obtain information about the origin, recipients and purpose of your stored personal data free of charge. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you may withdraw that consent at any time with effect for the future. You also have the right to request that the processing of your personal data be restricted under certain circumstances. Finally, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and any other questions about data protection.

2. Hosting

Hetzner

We host our website with Hetzner. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter: Hetzner). The servers are located in Germany; no transfer to third countries takes place.

When you visit our website, Hetzner records various log files including your IP address. For details, see Hetzner’s privacy policy: https://www.hetzner.com/de/rechtliches/datenschutz .

Hetzner is used on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. Where consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (such as device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

We have concluded a data processing agreement with Hetzner in accordance with Article 28 GDPR.

2a. Market and company data (EODHD)

For share prices, price histories, fundamentals and company data we use the service EOD Historical Data (EODHD). All requests are made server-side by us. Your device does not connect to EODHD and no personal data about you is transmitted to EODHD. Only the identifiers of the securities concerned (such as ISIN or ticker symbol) are sent.

The legal basis is Article 6(1)(b) GDPR (performance of the user agreement) and Article 6(1)(f) GDPR: without market data the application cannot serve its purpose.

2b. Payment processing (Stripe)

We use Stripe to process paid subscriptions taken out via our website. For users in the European Economic Area the provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter: Stripe).

When you make a purchase, the data required to process the payment (in particular name, email address and payment details) is transmitted to Stripe. Your full payment details are processed exclusively by Stripe; we do not receive them.

The legal basis is Article 6(1)(b) GDPR (performance of a contract). Further information: https://stripe.com/de/privacy .

Purchases made through the iOS and Android apps are not processed via Stripe but through the app store of the respective operating system vendor. Their privacy terms apply in that case.

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the internet (for example when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller for data processing on this website is:

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (such as names or email addresses).

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for processing it no longer applies. If you assert a justified request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing it (such as retention periods under tax or commercial law); in the latter case, deletion takes place once those grounds cease to apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR where special categories of data under Article 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, processing is also carried out on the basis of Article 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (for example via device fingerprinting), processing is additionally based on Section 25(1) TDDDG. Consent may be withdrawn at any time. Where your data is required for the performance of a contract or for pre-contractual measures, we process it on the basis of Article 6(1)(b) GDPR. We also process your data where this is necessary to fulfil a legal obligation, on the basis of Article 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Article 6(1)(f) GDPR. The relevant legal bases in each individual case are set out in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business we work with various external parties. This sometimes requires personal data to be transmitted to them. We only pass personal data to external parties where this is necessary to perform a contract, where we are legally obliged to do so (for example when passing data to tax authorities), where we have a legitimate interest under Article 6(1)(f) GDPR in doing so, or where another legal basis permits it. Recipients of the personal data may be given further data protection information.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw consent already given at any time. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Article 21 GDPR)

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS CONNECTED WITH SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ARTICLE 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement. This right exists without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where it is technically feasible.

Information, correction and deletion

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to have this data corrected or deleted. You can contact us at any time regarding this and any other questions about personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time to do so. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of the personal data we hold about you, we usually need time to verify this. For the duration of that check you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was or is unlawful, you may request the restriction of processing instead of deletion.
• If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of processing instead of deletion.
• If you have lodged an objection under Article 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent or to assert, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of your browser changing from “http://” to “https://” and by the padlock symbol in the browser bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Objection to promotional emails

We hereby object to the use of contact data published in the context of the legal notice obligation for sending unsolicited advertising and information material. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising being sent, for example by spam email.

4. Data collection on this website

Cookies

Our web pages use so-called cookies. Cookies are small data packets and do no harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or your browser deletes them automatically.

We use only technically necessary cookies that are required for the operation of the website and for signing in. These cookies store your sign-in token so that you stay signed in. Consent is not required for these cookies, as they are permitted under Section 25(2)(2) TDDDG.

You can set your browser to inform you when cookies are set and to allow cookies only in individual cases, to exclude the acceptance of cookies in certain cases or generally and to enable the automatic deletion of cookies when the browser is closed. If cookies are disabled, the functionality of this website may be limited.

Server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser transmits to us automatically. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources.

This data is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of the website. For this, server log files must be recorded.

Contact form

If you send us enquiries via the contact form, the details you provide in the enquiry form, including the contact details you give there, will be stored by us in order to process the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR) where this has been requested; consent may be withdrawn at any time.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it no longer applies (for example once your enquiry has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Registration on this website

You can register on this website in order to use additional functions of the service. We use the data entered for this purpose only for the use of the respective offer or service for which you registered. The mandatory details requested during registration must be provided in full. Otherwise we will refuse the registration.

For important changes, such as to the scope of the offer or for technically necessary changes, we use the email address provided at registration to inform you.

The data provided during registration is stored by us for the duration of your use of the service and deleted afterwards. Statutory retention periods remain unaffected.

Registration and the associated storage of data are based on Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(a) GDPR (consent through active registration).

Signing in is handled by Nexxus ID, our own sign-in system. It runs on servers that we operate ourselves at Hetzner Online GmbH in Germany. No third party is involved; your credentials do not leave our systems.

Processing of customer and contract data

We collect, process and use personal customer and contract data in order to establish, shape and amend our contractual relationships. We collect, process and use personal data about the use of this website (usage data) only to the extent necessary to enable the user to use the service or to bill for it.

Within the Nexxus Pilot app, the following user-specific data is stored:

• Portfolio data (shares, purchase prices, purchase date, quantity, notes)
• Watchlist entries (securities being followed)
• Price alerts (thresholds, alert status)
• User profile (subscription tier, language settings)

The customer data collected is deleted once the order is completed or the business relationship ends. Statutory retention periods remain unaffected.

The legal basis for this data processing is Article 6(1)(b) GDPR (performance of a contract). All data is stored and processed on servers that we operate ourselves at Hetzner Online GmbH in Germany.

5. Use of artificial intelligence

On this website and in the Nexxus Pilot app we use functions based on artificial intelligence (AI) to provide you with additional analysis and to prepare information about securities.

Which AI systems do we use?

We use the API services of Anthropic, PBC (USA), in particular the Claude language model, to process user requests and generate responses.

What data is processed?

When you use an AI-supported function, your input (such as search queries or questions about securities) is transmitted to Anthropic’s servers and processed there. We transmit only the data necessary to answer your request. We avoid transmitting personal data as far as this is technically possible.

Legal basis and purpose

Data processing is carried out on the basis of Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interest in providing high-quality, AI-supported analysis). The transfer to the USA is based on standard contractual clauses under Article 46(2)(c) GDPR.

No automated decision-making

The AI-generated output does not constitute investment advice and is not used for automated decision-making within the meaning of Article 22 GDPR. All information is purely informational.

Further information on data processing by Anthropic can be found at: https://www.anthropic.com/privacy .