Privacy policy

1. Controller

The controller responsible for data processing on this website is:

Lenka Novák Investments GmbH, Thiersheimer Straße 24, 95659 Arzberg, Germany — email: info@novak-investments.de, phone: +49 172 8413924.

Registered intermediary pursuant to Sec. 34d (1) and Sec. 34f (1) of the German Trade Regulation (GewO), listed in the IHK intermediary register (www.vermittlerregister.info), registration no. D-RTWD-86AWZ-67.

2. General information and legal bases

We process personal data strictly within the scope of the applicable law, in particular the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and Sec. 25 of the German TDDDG. Depending on the operation, processing is based on:

• Art. 6 (1) (a) GDPR — your consent, for example for statistics cookies,
• Art. 6 (1) (b) GDPR — performance of a contract or pre-contractual steps, for example handling your enquiry,
• Art. 6 (1) (f) GDPR — our legitimate interest in operating this website securely and reliably.

This website uses SSL/TLS encryption throughout. Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers named below that process personal data on our behalf. Where providers are located outside the EU/EEA, transfers are safeguarded by the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

3. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, and delivered through a content delivery network; server-side functions run in Frankfurt am Main, Germany.

When you visit the website, Vercel processes technically necessary connection data (IP address, date and time of access, page requested, browser and device type) in order to deliver the pages and to keep the service secure and stable (Art. 6 (1) (f) GDPR). Server logs are deleted automatically after a short period.

4. Content management system (Sanity)

The content of this website (texts, images, videos) is managed with the content management system of Sanity AS, Skippergata 26, 0154 Oslo, Norway; media are delivered through its CDN. Enquiries you submit through our forms are also stored there for internal handling. Processing may take place on servers in the USA (safeguarded by the EU Standard Contractual Clauses).

5. Cookies and consent management (CookieYes)

A consent banner appears on your first visit to this website. Strictly necessary cookies are set on the basis of Sec. 25 (2) TDDDG and Art. 6 (1) (f) GDPR. All other cookies — such as statistics cookies — are set only with your consent (Art. 6 (1) (a) GDPR, Sec. 25 (1) TDDDG).

We manage your consent with CookieYes, a service of CookieYes Limited, 3 Warren Yard, Warren Park, Milton Keynes MK12 5NW, United Kingdom; the United Kingdom is covered by an adequacy decision of the European Commission. CookieYes stores your choice for twelve months in the “cookieyes-consent” cookie.

You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.

The following overview is kept up to date automatically and lists all cookies used on this website:

6. Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager itself does not set cookies and does not collect personal data; it manages website tags and controls them in line with your consent (Google Consent Mode v2). Downstream services are loaded only after you have given consent.

7. Google Analytics 4

If you have given consent (Art. 6 (1) (a) GDPR, Sec. 25 (1) TDDDG), we use Google Analytics 4, provided by Google Ireland Limited, to measure how our website is used. Pseudonymous usage data are processed (such as pages visited, session duration, approximate region and device type); IP addresses are truncated by Google at collection and are not logged.

Data may be transferred to servers of Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. Without your consent, no measurement takes place. You can withdraw your consent at any time via the cookie settings.

8. Contact and appointment requests

When you use our contact form, appointment request or questionnaire, we process the data you provide (such as name, email address, phone number, subject and preferred date) in order to handle your enquiry (Art. 6 (1) (b) GDPR). Your enquiry is stored in our internal system and forwarded to our mailbox.

Confirmation and notification emails are sent through Resend, a service of Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (safeguarded by the EU Standard Contractual Clauses). We delete enquiry data once the matter has been dealt with, unless statutory retention obligations require otherwise.

9. Job applications

Application documents (including CVs) are processed solely for the purpose of the recruitment procedure (Sec. 26 BDSG, Art. 6 (1) (b) GDPR). Documents of applicants who are not hired are deleted no later than six months after the procedure has ended, unless you have consented to longer storage.

10. Fonts and media

Fonts are served locally from our own server; no connection to Google Fonts or other external font services is established. Images and videos are delivered through the CDN of our content management system; no external video platforms are embedded.

11. Your rights

You have the following rights with regard to your personal data:

• access to the data processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on legitimate interests (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

An informal email to info@novak-investments.de is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Version

This privacy policy is effective as of July 2026. We will update it whenever the legal situation or the services we use change; the version published here applies.