Privacy notice

2 Website operation and security

The website is delivered through Cloudflare, Inc., United States. Processing includes technical access data such as IP address, time, requested page, browser and device information, and response status. This serves website delivery, troubleshooting and abuse prevention. The basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable website operation.

For technical data retained by the provider, Cloudflare describes retention criteria based on the processing purpose, data type and security risks, together with legal and contractual requirements. When the applicable retention period expires, Cloudflare deletes or destroys the data. Where technical reasons prevent this, Cloudflare states that it applies safeguards against further use.

Cloudflare uses international infrastructure; processing in the United States and other countries is possible. Further information: https://www.cloudflare.com/privacypolicy/.

We use the DNS service of Cloudflare, Inc., United States, to resolve our domain name. Cloudflare processes technical DNS query data to make the website reachable and identify disruptions. The basis is Article 6(1)(f) GDPR; our legitimate interest is reliable access to the website.

A separate website deployment is retained with Netlify, Inc., United States, at a netlify.app address for a possible return to Netlify. If you visit that deployment, Netlify processes technical access data for delivery, troubleshooting and abuse prevention. The Netlify processing of website access described here concerns that separate deployment. Its corresponding privacy notice applies there, including information about any Netlify analytics used on that deployment. Remaining logs and analytics data from previous Netlify operation are separate from new Cloudflare visits. International processing, including in the United States, is possible. Further information: https://www.netlify.com/privacy/.

3 Enquiries and business communication

When you contact us, we process your email address, enquiry and voluntary information such as your name, telephone number, company or project context. This includes technical information to associate the request and a record of the privacy information acknowledged on submission. Providing information for a non-binding enquiry is neither legally nor contractually required. However, we cannot handle the enquiry without the contact details and information necessary to do so.

We use the data to handle your enquiry and prepare or carry out a business relationship. Article 6(1)(b) GDPR applies where you are personally a contracting party or enquire about your own contract. For company contacts and other business enquiries, Article 6(1)(f) GDPR applies; our legitimate interest is appropriate communication with prospective clients and business partners.

For website enquiries, we use Cloudflare, Inc., United States, for transmission and temporary storage, USPACY OÜ, Estonia, as our CRM, and Google Workspace for business email communication and filing. For general enquiries, you can also contact hello@360node.de.

After confirmed CRM delivery, message content is deleted from transmission storage. Unresolved deliveries are scheduled for cleanup after 72 hours; technical outages may delay this. Technical delivery records remain for 24 hours after delivery or actual cleanup, and recovery history for seven days.

In the CRM and email system, enquiries are retained to handle them and any subsequent business exchange. Once concluded, they are deleted when no further exchange is expected and no retention or evidence-related grounds remain. Business records subject to statutory retention are kept for the applicable period under Article 6(1)(c) GDPR. Article 6(1)(f) GDPR applies to necessary establishment or defence of specific legal claims.

Provider information: https://www.cloudflare.com/privacypolicy/, https://uspacy.com/data-processing-addendum/ and https://cloud.google.com/terms/data-processing-addendum/.

4 Contact-form protection

Cloudflare Turnstile loads when you interact with the form to detect automated abusive requests. Cloudflare processes technical connection and browser signals, including IP address, browser identifier and the website accessed. The check operates independently of optional analytics and chat.

Form protection is based on Article 6(1)(f) GDPR; our legitimate interest is preventing spam and attacks. Where device access is strictly necessary for the secure form feature you expressly request, section 25(2), no. 2 of the German Telecommunications and Digital Services Data Protection Act (TDDDG) applies. This exception does not cover optional analytics. Cloudflare also describes its own processing to improve bot detection, for which it acts as controller and identifies its own legitimate interests. Details: https://www.cloudflare.com/turnstile-privacy-policy/.

5 Cookies and your choices

CookieYes Limited, United Kingdom, manages your choices about optional services. Processing includes selected categories, a consent identifier, timestamps and technical request information. The necessary choice cookie lasts one year. Its browser lifetime is separate from the retention of any server-side consent records.

Managing and demonstrating required consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR. Strictly necessary device storage is governed by section 25(2), no. 2 TDDDG. We use optional services with consent under Article 6(1)(a) GDPR and, where device access is involved, section 25(1) TDDDG.

Through “Cookie settings” in the footer or on the privacy page, you can separately allow or reject functional services and analytics, or change your choices at any time. Withdrawal takes effect for the future and does not affect the lawfulness of earlier consent-based processing. The choice applies to the relevant browser. The settings show the cookies used, their purposes and lifetimes. Further information: https://www.cookieyes.com/privacy-policy/.

6 360Node Guide: optional AI assistant

The Guide answers questions about 360Node and helps prepare an enquiry. It is provided through AnyChat LLC and loads only after you agree to “Functional cookies”. Processing includes session and connection data, your messages and the conversation context used. The browser session identifier lasts for the session; its expiry does not automatically erase stored messages.

For AI responses, AnyChat sends the relevant messages through OpenRouter, Inc., United States, to the configured model or infrastructure provider. Processing outside the EU is possible.

The basis is your consent under section 5, which you can withdraw at any time in the cookie settings. The website form and email are also available without the Guide. Withdrawal ends further optional use; data already transmitted is not automatically erased.

If you expressly confirm a contact enquiry in the Guide, the designated contact details and enquiry are sent through Cloudflare to Uspacy. The handoff contains the confirmed details, not automatically the entire chat history. Section 3 and its retention periods apply to the enquiry. Messages at AnyChat are retained for the conversation and enquiry handling; the provider describes additional retention for legal duties, specific disputes and abuse prevention.

Provider information: https://anychat.one/privacy-policy and https://openrouter.ai/privacy.

7 Optional analytics with TruConversion

With your consent to “Analytics cookies” under section 5, we use TruConversion to analyse and improve the website. The provider's terms identify Infinitegoose Inc. Processing covers page views, clicks, scrolling, technical usage information and visitor journeys. Session recordings reconstruct page content and interactions; heatmaps show frequently used areas.

Session cookies last for the session. The visitor identifier and related persistent analytics cookies are limited to at most 365 days from creation. Withdrawal through cookie settings stops further analytics. It does not automatically erase data already held by the provider. The plan in use lists six months of data retention; necessary statutory retention and specific disputes may affect individual records for longer. Processing outside the EU is possible. Further information: https://www.truconversion.com/privacy-policy/ and https://www.truconversion.com/term-of-use/.

8 Recipients and international transfers

Recipients are the providers named for the relevant feature and their necessary downstream providers. Other recipients may include legally entitled authorities or advisers bound by confidentiality, where necessary for legal duties or specific legal matters.

For transfers to Netlify and Cloudflare, the incorporated data processing terms provide for the EU-US Data Privacy Framework and EU Standard Contractual Clauses for transfers not covered by that framework. CookieYes in the United Kingdom is covered by a European Commission adequacy decision; Standard Contractual Clauses are agreed for restricted onward transfers. Uspacy is based in Estonia; its data processing agreement includes Standard Contractual Clauses for the third-country transfers addressed in that agreement. Information and copies of the relevant safeguards are available through info@360node.de; protected third-party information may be redacted.

9 Google Analytics 4

With your consent to the Analytics category, we use Google Analytics 4 (Standard), provided by Google Ireland Limited, Ireland, to analyse our website and contact journeys. It helps us understand which content is used and whether visitors choose a contact option, start the contact form or successfully submit an enquiry. If you also consent to functional services, we measure opening and closing the 360Node Guide chat window and selecting its contact link. Chat contents and contact details entered in the Guide are not passed to Google Analytics.

Data includes cleaned page addresses, timestamps, pseudonymous cookie and session identifiers, and technical browser, device, language and approximate regional information. For broad campaign attribution, we pass only predefined campaign values. Arbitrary URL parameters, advertising click identifiers and fragments are removed. External referrers are limited to the originating website. Form entries, names, email addresses, phone numbers and enquiry identifiers are not passed to Google Analytics. On contact pages we send specified contact events instead of pageviews; Google may add technical session and interaction data. Legal pages and local previews are excluded.

Google Analytics uses the _ga and _ga_* cookies to recognise browsers and sessions. Both cookies are configured for 365 days; automatic renewal of _ga is disabled. The session-state cookie (_ga_*) may be renewed during session updates and then remain for up to 365 days from its latest update. Your browser may shorten this period. The Google script and analytics requests are allowed only after your Analytics consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw consent for the future through Cookie settings in the footer. Enabled Do Not Track or Global Privacy Control signals are respected. Withdrawal does not automatically delete data already stored by the provider.

The integration is limited to usage analytics. We do not use Google signals, User-ID, enhanced conversions, automatic form collection or personalised advertising. Additional granular location and device collection is disabled. Advertising storage, advertising user data and ad personalisation remain denied. The selected campaign values do not establish a connection to a Google Ads account.

Detailed user and event retention is set to 14 months, without resetting the user retention period on further activity. Google applies retention changes after 24 hours and deletes expired data during its monthly deletion process. This setting does not apply to standard aggregated reports; summary statistics may remain available for longer. Cookie lifetime is separate. No additional local archive is currently configured.

Google processes analytics data under its data-processing terms; affiliates and subprocessors may be involved. Processing outside the EEA, particularly in the United States, is possible. Google identifies the EU-U.S. Data Privacy Framework for transfers to Google LLC and, where applicable, standard contractual clauses for other covered transfers. According to Google's documentation, IP addresses of EU, Swiss and UK users are discarded before logging; the technical connection and derivation of an approximate region remain processing steps. Further information: https://policies.google.com/technologies/partner-sites and https://business.safety.google/adsdatatransfers/. The processing terms and subprocessors are available at https://business.safety.google/adsprocessorterms/ and https://business.safety.google/adssubprocessors/.

10 Your rights

Subject to the statutory conditions, you have rights of access and a copy of your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). You can withdraw consent at any time with effect for the future.

You may object to processing based on legitimate interests on grounds relating to your particular situation (Article 21(1)). You may object to direct marketing at any time without giving reasons (Article 21(2) and (3)).

You may complain to a data protection supervisory authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement (Article 77). The directory of German authorities is at https://www.datenschutzkonferenz-online.de/datenschutzaufsichtsbehoerden.html.