DEEN

Privacy Policy

This English version is provided for convenience. The German version is the legally binding one.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

nava GmbH i.G.
Schauenburgerstr. 116, 24118 Kiel, Germany
Registered office: Kiel
Represented by the managing directors with sole power of representation, Sara Gubernator, Jesse Reese and Arne von Pichowski
Email: info@hey-nava.com

2. General Information on Data Processing

As a rule, we process our users’ personal data only to the extent necessary to provide a functioning website and our content and services. Processing is based on the applicable legal bases of the GDPR, in particular Art. 6(1)(a) (consent), (b) (contract or pre-contractual measures) and (f) (legitimate interests).

3. Hosting and Server Log Files

This website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA. We have a data processing agreement (Data Processing Addendum) with Netlify pursuant to Art. 28 GDPR; for the associated data transfer to the USA, Netlify relies on the EU Standard Contractual Clauses. Further information: https://www.netlify.com/gdpr-ccpa/.

When you visit our website, the hosting provider automatically collects information in so-called server log files, which your browser transmits automatically. This includes:

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation, stability and security of our website. These data are not merged with other data sources. The log files are automatically deleted after a short time.

4. Contacting Us by Email

If you contact us by email, the data you provide (email address and, where applicable, your name and the content of your message) will be processed for the purpose of handling your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry relates to the initiation of a contractual relationship, and otherwise Art. 6(1)(f) GDPR. We delete the data as soon as it is no longer required to achieve its purpose and no statutory retention obligations apply.

We also process personal data (name, email address, contact details, content of correspondence) when we initiate contact ourselves, e.g. with investors, business partners, suppliers and pilot customers, as well as in ongoing business correspondence. The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in initiating business relationships and in business communication).

For email communication we use Microsoft 365 (Exchange Online) provided by Microsoft Ireland Operations Limited and Microsoft Corporation, respectively. Microsoft processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Insofar as data may be transferred to the USA in the process, this takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

Statutory retention obligations take precedence over deletion: we retain commercial and business letters for 6 years (§ 257 HGB, § 147 AO) and tax-relevant documents for 10 years. After that, the data is deleted.

5. Pilot Program Sign-Up

On our website you can register for our pilot program using a form. In doing so, we process the data you provide:

Providing this information is voluntary. Before submitting, you confirm via a checkbox that you have read this privacy policy and agree to the processing of your data for the stated purpose. The legal basis is therefore primarily your consent (Art. 6(1)(a) GDPR); insofar as the sign-up serves to initiate participation in the pilot program, we additionally rely on Art. 6(1)(b) GDPR (pre-contractual measures). You can withdraw your consent at any time with effect for the future by emailing info@hey-nava.com.

Your data is not passed on to third parties. We store it only for as long as necessary for the stated purpose, that is, for the duration of the pilot program and its evaluation. After that, we delete it unless statutory retention obligations apply. If you withdraw your consent or object to the processing, we will delete your sign-up without delay.

Technical Spam Protection

To prevent automated form submissions (spam), we use a form field that is invisible to humans (“honeypot”) and a minimum time span between loading and submitting the form. Both checks are carried out technically upon submission and serve our legitimate interest in a functioning, abuse-free sign-up process (Art. 6(1)(f) GDPR). The content of the invisible field and the measured time span are stored together with your sign-up so that we can identify spam entries afterwards. Beyond that, no data about you is collected; in particular, no third-party services (e.g. CAPTCHA providers) are integrated and no information is stored on or read from your device.

Hosting of Sign-Up Data (Supabase)

The data submitted via the pilot program form is not stored and processed by us directly, but by our database service provider Supabase (Supabase, Inc.). Storage takes place on servers within the EU (region eu-west-1, Ireland). Access to the database is technically restricted (Row Level Security) so that the website can only create new sign-ups, but cannot read, modify or delete existing data. We have a data processing agreement with Supabase pursuant to Art. 28 GDPR on the basis of its Data Processing Addendum. Further information: https://supabase.com/legal/dpa and https://supabase.com/privacy.

We operate a shared database there for our various applications. The data of this website is kept in its own separate area within it. Your sign-up data is not merged with data from other sources or applications.

6. Anonymous Audience Measurement

This website does not use cookies for analytics or marketing purposes. To understand how often and when our pages are visited, we collect the following information on each page view:

We do not store IP addresses and do not create identifiers that would allow individual visits to be linked to one another. For this measurement, no information is stored on or read from your device, so neither cookies nor your browser’s session or local storage are used. Consent under § 25 TDDDG is therefore not required. The data collected is deliberately kept so coarse that we cannot attribute it to any specific person; nor is it merged with other data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in optimizing our offering). You can object to this processing at any time by emailing info@hey-nava.com. The data is stored with our service provider Supabase (see section 5). We evaluate it only in aggregated form and retain it only for as long as necessary for this statistical evaluation.

7. Storage of Your Language Setting

If you choose a language using the “DE / EN” switcher, we store your choice in a cookie named nava_lang_de or nava_lang_en on your device (the other one is deleted). It contains only the value “1” and no identifier by which you could be recognized. The cookie ensures that the next time you open the home page, it is shown directly in the language you chose. It is set only when you actively use the switcher and is deleted automatically after one year; you can remove it in your browser at any time. Without this cookie, the language of the home page is based on your browser’s language setting, which it transmits with every page request anyway. Since the cookie is strictly necessary for a function you have expressly requested, consent under § 25(2) No. 2 TDDDG is not required. The cookie is not used for analytics or marketing purposes.

8. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the lock icon in your browser’s address bar and by the address changing from “http://” to “https://”.

9. Your Rights as a Data Subject

You have the following rights with respect to us regarding the personal data concerning you:

To exercise your rights, an informal email to info@hey-nava.com is sufficient.

10. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Independent Center for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de.

11. Changes to This Privacy Policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The current version applies to your next visit.

As of: November 2026

← Back to home page