Privacy policy
This policy applies to the website www.nxtlvl-corp.com. For websites we build or run for clients, the respective client is the controller; their privacy policy and our data processing agreement (https://www.nxtlvl-corp.com/avv, German) apply there.
1. Controller
NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz (General Manager).
Email for data protection questions and exercising your rights: [email protected], phone: +971 58 302 5922
You can contact us directly with any data protection matter at any time.
Data protection officer: No data protection officer has been appointed at present. The contact is the controller at the address above.
2. Overview
| Purpose | Data | Legal basis |
|---|---|---|
| Accessing the website, delivery, security | IP address, time, requested address, referrer, browser and device information (server logs at Cloudflare) | Art. 6(1)(f) GDPR (secure and stable operation) |
| Light/dark display (only if you use the toggle) | chosen display („light“/„dark“) in your browser's storage (localStorage, key nx-theme); not transmitted to us | Section 25(2) no. 2 TDDDG; no processing of personal data by us |
| Contact and enquiries by email or phone, intro call | your message, email address, phone number, name, company and any other information you provide | Art. 6(1)(b) GDPR (steps prior to or performance of a contract), otherwise (f) (our legitimate interest in answering enquiries) |
| Offers, contracts and invoicing (if you become a client) | name and contact details of contact persons, company and billing details, contract and payment data | Art. 6(1)(b) GDPR; (c) for retention obligations |
We ourselves use no cookies, no advertising services, no social media plug-ins, no embedded third-party content (e.g. videos, maps) and no third-party fonts on the website. We do not build user profiles and do not track you across other websites. We serve all files of the site ourselves (fonts „Inter“ and „Instrument Serif“, images, videos, scripts) and do not embed any analytics or measurement scripts, including none from Cloudflare. We do not make automated decisions within the meaning of Art. 22 GDPR and do not sell data.
Obligation to provide data: You are not obliged to provide us with data. Without the technically necessary connection data (section 3), however, the website cannot be displayed; without your email address we cannot reply to you.
3. Hosting and server logs (Cloudflare Pages)
The website is delivered via Cloudflare Pages (Cloudflare, Inc., USA; global network, delivery from the nearest location). When you access it, Cloudflare processes, as technically necessary, the IP address, date and time, the requested address, the referrer and browser and device information in order to deliver the page and fend off attacks (e.g. DDoS protection). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and fast operation.
Cloudflare processes this data as our processor (Cloudflare Data Processing Addendum). For transfers to the USA, the Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework (DPF) apply, where relevant; you can obtain a copy of the safeguard on request.
From these server logs, Cloudflare provides us with aggregated figures (e.g. number of requests, data volume, countries of origin); we cannot identify individual visitors there and do not combine these figures with other data.
Storage period: Server logs are stored briefly, usually for no longer than 30 days, unless they are needed longer to investigate a security incident.
4. Contact, intro call and contracts
The website has no contact form. It only contains email links ([email protected]) that open your own email program; some links suggest a subject and a text template that you can change freely. If you write to us, we process your message, your email address and the information you provide in order to answer your enquiry, arrange an intro call and, where applicable, prepare an offer (Art. 6(1)(b) GDPR for enquiries about a contract, otherwise (f); our legitimate interest is answering enquiries).
As a rule, we delete the correspondence no later than 3 years after the enquiry has been completed if no contract is concluded. If a contract is concluded, we keep correspondence and documents for as long as is necessary for the contract and statutory retention obligations. Our mailbox is operated by an external email provider as our processor; we will name the provider on request.
If you call us, we process your phone number and the content of the conversation, insofar as we take notes, for the same purposes. We hold intro calls by phone or video conference. If we use a video conferencing service, we name it in the invitation; the provider processes connection and participant data as our processor. We do not record calls.
If you become a client: For offer, contract, project delivery and invoicing we process the contact details of your contact persons as well as company, billing, contract and payment data (Art. 6(1)(b) GDPR). We keep invoices and accounting records for as long as statutory retention obligations apply ((c)), usually up to 10 years. If you pay for care by card or direct debit via a payment service (e.g. Stripe), that service processes the payment data; we will tell you which service is used and who is responsible before the first payment.
We do not contact anyone unsolicited for advertising purposes.
5. Local storage in the browser
We do not set cookies and do not use sessionStorage. Should Cloudflare, in individual cases, set a technically necessary security cookie to fend off attacks (for example during a browser check), it serves only this purpose (Section 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR); neither we nor Cloudflare on our behalf set cookies for analytics or advertising.
Only if you switch between light and dark display in the header does your browser store your choice in localStorage (key nx-theme, value „light“ or „dark“) so that the display stays the same on your next visit. The value does not leave your browser; you can remove it via your browser settings („clear site data“). Without switching, the display follows your device setting without anything being stored.
6. Fonts, media and links
We load fonts, images, videos and program libraries from our own server; no data is transferred to font or media providers. The website links to websites we have built for clients. Only when you click such a link does your browser open the third-party page; its operator then receives your IP address and, as referrer, only our domain (www.nxtlvl-corp.com), not the exact subpage. The privacy policy of the linked page applies there.
7. Recipients and third countries
| Service | Purpose | Location / processing | Safeguard |
|---|---|---|---|
| Cloudflare | Hosting (Pages), network, security, server logs | Cloudflare, Inc., USA; worldwide | Data processing agreement; SCC or DPF, where relevant; copy on request |
| Email provider | Mailbox for [email protected] | external provider; details on request | Data processing agreement; SCC or DPF, where relevant; copy on request |
| Video conferencing service (only for intro calls by video) | Holding the call | stated in the invitation | Data processing agreement; SCC or DPF, where relevant; copy on request |
United Arab Emirates: As the controller, we are established in the UAE. There is no adequacy decision of the European Commission for the UAE. We apply the GDPR insofar as it applies to our offering (Art. 3(2) GDPR) and access the data only via secured, encrypted connections. Where data from the EU reaches the UAE in this context, this happens in order to answer your enquiry or to run the website.
8. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Please contact [email protected]; we usually reply within one month.
9. Right to object (Art. 21 GDPR)
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR) – in particular server logs and answering general enquiries – you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal note to [email protected] is sufficient.
You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until then remains unaffected. At present we do not base any processing on this website on consent.
10. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or the place of the alleged infringement; in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC).
11. Changes
We update this policy when the website, the services used or the legal situation change. The current version is available at https://www.nxtlvl-corp.com/en/privacy.
As of: 20 October 2026