Data Privacy

Privacy Policy NautilusLog Platform

(“Privacy Policy”)

Version 1.2 – Last updated: August 14, 2026

I. General information on data processing

1. Scope of the data processing of personal data

We collect and use personal data of users of our website where you can sign in for and log in onto the NautilusLog Platform (“Platform”), subscribe to services by us or third parties only to the extent necessary.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations which are necessary to carry out pre-contractual measures.

Insofar as processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or of a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.

If the processing of data requires the storage of information in your device or access to information already stored in the device, Section 25 (1), (2) TDDDG is the legal basis for this.

3. Data deletion and storage period

The personal data of the user will be deleted or blocked as soon as the purpose of the storage no longer applies. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU ordinances, laws or other regulations to which the person responsible is subject. Data will also be blocked or deleted when a storage period prescribed by the above-mentioned standards expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.

4. General communication

You can contact us via the Platform, by e-mail, telephone or letter. Your details and attachments from the inquiry, including the contact data you provide there, will be stored by us solely for the purpose of processing the inquiry and in the event of follow-up questions. In the case of contact forms, your connection data such as IP address and the date and time of submission are also processed. If you contact us by e-mail, your e-mail address and the date and time of sending will be processed. If you contact us by telephone, the telephone number will be processed. If you write to us by letter, we process your address data and date of receipt. In this context, the data will not be passed on to third parties.

The legal basis for processing the data is Art. 6 para. 1 lit. f GDPR. Our interest in answering your inquiry outweighs your interest; since you are writing to us, an answer is furthermore also in your interest, and you are aware that we need to process your data to answer your inquiry. The connection data is collected in order to be able to process and answer your inquiry and to prevent misuse of the contact options.

If the contact aims at the conclusion of a contract, the legal basis for the processing is Art. 6 para 1 lit. b GDPR.

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case when the respective communication with the data subject has ended. The communication is terminated when it can be inferred from the circumstances that the matter concerned has been conclusively clarified.

5. Recipients of data

Within our company, those departments have access to your data that need it to fulfill their processing purposes. This also applies to the service providers and vicarious agents we use. All departments and persons who work with your data are bound to data secrecy and have been made aware of the sensitive handling of personal data.

Your data will only be passed on outside the company if this is in accordance with data protection regulations. This is the case if the transfer is necessary to fulfill the purposes or if we have obtained your consent for the use and transfer of the data. The following categories of recipients may receive your data:

• Service providers for the operation of our Platform and services and the processing of data stored or transmitted by the systems (e.g. for data center services, payment processing, IT security). The legal basis for the processing is then Art. 6 para. 1 lit. b or lit. f GDPR, insofar as it does not involve order processors.
• Government agencies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the transfer is then Art. 6 para. 1 lit. c GDPR.
• Persons employed to carry out our business operations (e.g. auditors, banks, insurance companies, legal advisors, supervisory authorities, parties involved in company acquisitions or the establishment of joint ventures). The legal basis for the disclosure is then Art. 6 para. 1 lit. b or lit. f GDPR.

6. Data sources

We mainly receive your personal data directly from you.

If we receive your data from other third parties (for example, recommendations from other partners), we will inform you about these data sources when you initially contact us.

7. Rights

If your personal information is processed, you have the following rights.

a) Right of access

You have the right to obtain from us confirmation as to whether or not personal information concerning you are being processed, and, where that is the case, access to the personal data and the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. the existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal information or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from you, any available information as to their source;
8. the existence of automated decision-making, including profiling, referred to in Art. 22 para. 1 and 4 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transmission.

b) Right of rectification

You have the right to obtain from us within undue delay the rectification of inaccurate or incomplete personal information. Taking into account the purposes of the processing, you shall have the right to have incomplete personal information completed, including by means of providing a supplementary statement.

c) Right to restriction of processing

You shall have the right to obtain from us restriction of processing where one of the following applies:

1. the accuracy of the personal data is contested by yourself, for a period enabling us to verify the accuracy of the personal data;
2. the processing is unlawful and the data subject opposes the erasure of the personal information and requests the restriction of their use instead;
3. we no longer need the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
4. You have objected to processing pursuant to Art. 21 para. 1 pending the verification whether the legitimate grounds override those of the data subject.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

If you have obtained restriction of processing pursuant to the above, you shall be informed by us before the restriction of processing is lifted.

d) Right to erasure (‘right to be forgotten’)

You shall have the right to obtain from us the erasure of personal information concerning you without undue delay and we shall have the obligation to erase personal information without undue delay where one of the following grounds applies:

1. the personal information is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. you withdraw consent on which the processing is based according to Art. 6 para.1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, and where there is no other legal ground for the processing;
3. you object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para 2 GDPR;
4. the personal information has been unlawfully processed;
5. the personal information has to be erased for compliance with a legal obligation in the European Union
6. the personal information has been collected in relation to the offer of information society services referred to in Article 8 para.1.

Where we have made the personal information public and is obliged pursuant to the above to erase the personal information, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

The right to erasure shall not apply to the extent that processing is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by the European Union or for the performance of a task carried out in the public interest
3. for reasons of public interest relating to public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the DPA;
4. for archiving, scientific or historical research purposes in the public interest or for statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to make it impossible or seriously impede the attainment of the objectives of such processing, or
5. for the establishment, exercise or defence of legal claims.

e) Notification regarding rectification or erasure of personal data or restriction of processing

We shall communicate any rectification or erasure of personal data or restriction of processing carried to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request it.

f) Right to data portability

You have the right to receive the personal information, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal information have been provided, where:

1. the processing is based on consent pursuant to Art. 6 para 1 lit. a or Art. 6 para 1 lit. b or Art. 9 para 2 lit. a
2. the processing is carried out by automated means.

The right shall not adversely affect the rights and freedoms of others.

In exercising your right to data portability you shall have the right to have the personal information transmitted directly from one controller to another, where technically feasible.

The exercise of this right shall be without prejudice to the right of erasure. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

g) Right to object

You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 para. 1 lit e) or lit. f). We shall no longer process the personal information unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

Where personal information is processed for direct marketing purposes, you shall have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal information shall no longer be processed for such purposes.

At the latest at the time of the first communication with you, the right referred to above shall be explicitly brought to your attention and shall be presented clearly and separately from any other information.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise his or her right to object by automated means using technical specifications.

h) Right to revoke the declaration of consent

You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the legality of the processing that has taken place on the basis of your consent until revocation.

i) Automated individual decision-making

You shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you

This shall not apply if the decision:

1. is necessary for entering into, or performance of, a contract between you and us
2. is authorised by European Union law and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
3. is based on your explicit consent.

We shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express our point of view and to contest the decision.

Decisions shall not be based on special categories of personal data referred to in Art. 9 para. 1 unless Art. 9 para.2 lit. a) or lit g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

j) Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the European Member State where you reside, work or suspect of infringement, if you believe that the processing of personal information concerning you is not in compliance with GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.

II. Data processing when accessing our website www.nautiluslog.com (including our help portal help.nautiluslog.com) (“Website”)

1. Making available the Website and creating log files

When our Website is accessed, our system will automatically collect data and information from the computer system of the terminal device accessing the Website.

In this connection the following data will be collected for a limited time period:

1. visited website
2. quantity of data transmitted
3. information about the type and version of the browser used (if transmitted by the user)
4. the operating system of the user
5. the IP address of the user
6. the date and time of access
7. the website/URL from which the system of the user arrived on our Website (if transmitted by the user)

Such data will be stored in log files of our system. Such data are needed only to analyze any malfunctions and will be erased at the latest within seven days. The legal basis for temporarily storing data in log files is Art. 6 para. 1 lit. f) GDPR. Temporary storage of the IP address for the system is necessary for making the Website available to the device of the user. For this purpose the IP address of the user must be stored for the duration of the session. Data are stored in log files to ensure the functionality of our Website. In addition, such data are used to optimize the Website and to ensure the security of our IT systems. Data will not be analyzed for marketing purposes in this connection, and we will draw no inferences as to your identity. The aforementioned purposes also provide the basis of our legitimate interest in data processing within the meaning of Art. 6 para. 1 lit. f) GDPR. Collecting data to make available the Website and storing data in log files is necessary for operating the Website. Consequently, users have no right to object to the collection or use of such data for the aforementioned purposes.

2. Cookies

Our Website uses cookies and comparable technologies. Cookies are small text files stored in your terminal device which allow your browser to be recognized across page changes and visits.

Strictly necessary cookies are required for the operation of the Website, for example to maintain your session. These are stored without your consent on the basis of Section 25 (2) no. 2 TDDDG; the subsequent processing of personal data is based on Art. 6 para. 1 lit. f GDPR, our legitimate interest being the technically reliable provision of the Website. Data from strictly necessary cookies is not used to identify you or to create user profiles.

Optional cookies serve the analysis of Website use and the improvement of user-friendliness, effectiveness and security, including the cookies described in Section II.3. These are stored only after you have given your consent via our cookie banner, on the basis of Section 25 (1) TDDDG and Art. 6 para. 1 lit. a GDPR. Until consent is given, no optional cookies are set.

You can review, change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our Website. You may also configure your browser to block or delete cookies; parts of the Website may then not function correctly.

3. Data processors

To provide the Website we use the services of our processor HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany, VAT DE312070441. We have concluded data processing agreements with our processors. Personal data will be processed by our processors only within the European Union, unless expressly stated otherwise in this Privacy Policy.

Google Analytics

On our Website we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and comparable technologies to store information on your terminal device and to read information already stored there in order to analyze your use of the Website.

In this connection the following data are in particular processed: a pseudonymous identifier assigned to your browser or device (client ID), the pages and subpages accessed, the date, time and duration of your visit, the referrer URL, information on the browser and operating system used, the device type, and approximate location data derived from your IP address (country, region, city). Google Analytics 4 does not store your IP address; the IP address is used transiently for the purpose of determining the approximate location and is then discarded.

The purpose of the processing is the analysis of the use of our Website, the measurement of reach and the improvement of our online offering. We do not use Google Analytics to create cross-site advertising profiles.

The legal basis for storing information on, and accessing information already stored in, your terminal device is Section 25 (1) TDDDG. The legal basis for the subsequent processing of personal data is your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you give via the cookie banner on our Website. Google Analytics is loaded only after you have given that consent; until then no analytics cookies are set and no data is transmitted to Google (Google Consent Mode, denied by default). You may revoke your consent at any time with effect for the future via the cookie settings on our Website; the lawfulness of the processing carried out on the basis of your consent until revocation remains unaffected. Independently of the cookie settings, you can prevent the collection of your data by Google Analytics by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout.

In the context of the use of Google Analytics, data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, and thus to a third country. Google LLC is certified under the EU-U.S. Data Privacy Framework, so that the transfer takes place on the basis of the adequacy decision of the European Commission of 10 July 2023 pursuant to Art. 45 GDPR. In addition, we have concluded the standard contractual clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR with Google.

The data collected via Google Analytics are deleted by Google after two (2) months at event level and after fourteen (14) months at user level. Further information on the processing of data by Google can be found in Google’s privacy policy at https://policies.google.com/privacy.

Google Tag Manager

We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage and deploy the tags used on our Website. Google Tag Manager is a purely technical administration tool: it does not itself create user profiles, does not set cookies for analysis purposes and does not store any information in your terminal device beyond what is technically necessary to deliver the tool.

When Google Tag Manager is loaded, your IP address is processed for the purpose of transmitting the tool to your terminal device. Google Tag Manager is configured in such a way that tags which are not strictly necessary are triggered only after you have given the corresponding consent via our cookie banner; if you refuse or revoke your consent, the affected tags are not executed.

The legal basis for the delivery of Google Tag Manager and for the strictly necessary tags is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the technically reliable administration of the Website. For all tags requiring consent, the legal bases are Section 25 (1) TDDDG and your consent pursuant to Art. 6 para. 1 lit. a GDPR. Data may in this connection be transferred to Google LLC in the USA; the safeguards described in the preceding section apply accordingly.

HubSpot

We use HubSpot, a service of HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany (“HubSpot”), for the analysis of Website use, for contact management and for marketing purposes. The analytics functions of HubSpot are used on our help portal help.nautiluslog.com and will additionally be used on www.nautiluslog.com. HubSpot sets cookies in your terminal device which serve to recognize your browser and to record the pages you visit.

In this connection the following data are in particular processed: a pseudonymous visitor identifier, the pages and subpages accessed, the date and time of access, the referrer URL, information on the browser and operating system used, the IP address, and – insofar as you make entries in forms on our Website – the data you enter there. The cookies used for visitor recognition and page-view analysis have a lifetime of up to six (6) months; session cookies are deleted at the end of the respective session.

The legal basis for storing information on, and accessing information already stored in, your terminal device is Section 25 (1) TDDDG, and the legal basis for the subsequent processing of personal data is your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you give via our cookie banner. You may revoke your consent at any time with effect for the future via the cookie settings on our Website. Insofar as you contact us via a form and the processing serves to answer your inquiry or to prepare a contract, Art. 6 para. 1 lit. b and lit. f GDPR apply in addition, as set out in Section I.4.

We have concluded a data processing agreement with HubSpot pursuant to Art. 28 GDPR. Under that agreement, data are transferred to HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA, which processes the data on a continuous basis and to which HubSpot Germany GmbH remains responsible to us for compliance. Insofar as data are transferred to the USA in this connection, HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework, so that the transfer takes place on the basis of the adequacy decision of the European Commission of 10 July 2023 pursuant to Art. 45 GDPR; in addition, the standard contractual clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR have been agreed with HubSpot. Further information can be found in HubSpot’s privacy policy at https://legal.hubspot.com/privacy-policy.

III. Data processing when using our Platform

Our Platform can be accessed via a browser ("Web app"), interface ("API") or via a mobile app ("App"). Web app (app.nautiluslog.com), API and App are together called Platform.

1. Register on the Platform

If you want to use our Platform you have to register to get an account (“Account”) and conclude an End User License Agreement (“EULA”). Registered holders of an Account are referred to in this Privacy Policy individually as a “User” and collectively as “Users”.

The following personal data is collected during registration:

• name
• email address
• password

As the processing of such personal data is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis.

The data will be deleted as soon as the contractual relationship is terminated, unless legitimate interests or legal obligations require further storage.

2. Usage of the Platform

During the use of the Platform, the following data are processed for the provision of the Platform and the services offered there:

When using the Platform via the App, our system automatically collects installation-specific meta data. The following data is temporarily processed for this purpose:

• Operating system version
• App version
• Device model and manufacturer

This data is only required for the technically correct operation of the App and for the analysis of any malfunctions and is anonymized within 180 days at the latest. The collection of the data is mandatory for the operation of the App.

As the processing of such personal data is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis.

The data will be deleted as soon as the contractual relationship is terminated, unless legitimate interests or legal obligations require further storage.

As we are obliged to analyze your data in order to make you aware of potential services, in connection with the data, we conduct such analyzes on the basis of Art. 6 para 1 lit. b) GDPR.

3. Processors

To provide the Platform we use the services of our processors Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen. We have concluded data processing agreements with our processors. Personal data will be processed by our processors only within the European Union, unless expressly stated otherwise in this Privacy Policy.

4. Activities

As a user you may create an organization (“Organisation”) and invite members (“Members”). Members can create, manage, delegate, administer and execute activities (“Activities”) and extend invitations for Activities to Users. Activities enable collaborations among Users. Users may participate in Activities as Members, but also in Activities of Organisations which they are not Members of.

We do not share data from Activities with third parties without the Organisation’s consent. However, we process and monitor the data to spot potential functional or technical errors, improve our services and to make you aware of the value of certain services. You may opt out of this service.

5. Subscription to services

Users may purchase services for the Organisations via the Platform.

As far as we as NautilusLog GmbH provide the services, the processing of personal data of our contractual partner is necessary for the performance of a contract, Art. 6 para. 1 lit. b GDPR serves as the legal basis. As far as the processing of personal data of employees/data subjects from our contractual partner is necessary, we base the processing on the basis of Art. 6 para. 1 lit. f GDPR. Our overruling legitimate interest is the proper fulfillment of the contract with of our contractual partner.

The data will be deleted as soon as the contractual relationship is terminated, unless legitimate interests or legal obligations require further storage.

As far as Organisations provide the services, the processing of personal data on our Platform is necessary for the performance of the EULA, Art. 6 para. 1 lit. b GDPR serves as the legal basis. As far as the processing of personal data of employees/data subjects from our contractual partner is necessary, we base the processing on the basis of Art. 6 para. 1 lit. f GDPR. Our overruling legitimate interest is the proper fulfillment of the contract with of our contractual partner. The data will be deleted as soon as the contractual relationship is terminated, unless legitimate interests or legal obligations require further storage.