Privacy Policy | Next Scientific GmbH

1. Responsible

The responsible party in terms of the General Data Protection Regulation is:

Next Scientific GmbH

Straßburger Weg 25

53113 Bonn

Germany

Represented by the managing director:

Dr. rer. nat. Thomas H. Schmidt

Phone: +49 228 850 386 44

E-Mail: mail@next-scientific.com

2. General Information

We process personal data only to the extent necessary to provide our website and the functions offered on it, you provide us with data for processing a request or for carrying out pre-contractual or contractual measures, a legal obligation exists, or another data protection legal basis permits the processing.

Personal data are information that relates to an identified or identifiable natural person.

Wir wenden bei der Verarbeitung insbesondere die Grundsätze der Zweckbindung, Datenminimierung, Richtigkeit, Speicherbegrenzung, Integrität und Vertraulichkeit an.

3. Legal Bases for Processing

Depending on the specific processing operation, we base the processing of personal data in particular on the following legal bases:

Art. 6 para. 1 lit. a GDPR, if you have consented to the processing
Art. 6 para. 1 lit. b GDPR, if the processing is necessary for the performance of a contract or for carrying out pre-contractual measures at your request
Art. 6 para. 1 lit. c GDPR, if the processing is necessary to comply with a legal obligation
Art. 6 para. 1 letter f GDPR, when the processing is necessary for the protection of our legitimate interests or the legitimate interests of a third party and does not override the interests, fundamental rights, or freedoms of the data subject

Soweit Informationen auf Ihrem Endgerät gespeichert oder aus diesem ausgelesen werden, gelten zusätzlich die Bestimmungen des § 25 TDDDG.

Technisch nicht erforderliche Speicherungen oder Zugriffe erfolgen nur nach Ihrer vorherigen Einwilligung. Eine Einwilligung ist nicht erforderlich, wenn die Speicherung oder der Zugriff unbedingt erforderlich ist, um eine von Ihnen ausdrücklich gewünschte Funktion bereitzustellen.

Weitere Informationen zu den eingesetzten Cookies und vergleichbaren Speichertechnologien finden Sie in unserer Cookie-Richtlinie.

4. Provision of the website and server logs

When you access our website, a technical communication takes place between your browser and the servers that provide our website. Information is transmitted or generated that is necessary for the delivery of the website, security, and error analysis.

In this context, the following data may be processed in particular:

IP address
Date and time of access
Accessed page or resource
Referrer URL
Browser type and browser version
Operating system and device platform
Language settings
Status code of the server response

The processing serves:

the technical provision of the website,
the secure and stable operation,
the detection and defense against abusive or harmful access,
error analysis and technical administration.

The legal basis is Art. 6 para. 1 letter f GDPR. Our legitimate interests lie in the secure, stable, and functional operation of our website as well as in the protection of our information technology systems.

As far as we have access to log data or these are stored in our Odoo database, they will be deleted as soon as they are no longer necessary for the stated purposes. If deletion is not technically possible immediately, further processing will be limited to the existing retention purposes. For log data processed by Odoo in the context of technical platform operations, the contractual and data protection regulations of Odoo also apply. Longer storage may occur if a security-related incident needs to be investigated or if legal obligations exist.

5. Hosting and Website Platform Odoo

Unsere Website, das Kundenportal und die damit verbundenen Funktionen werden über die Plattform Odoo Online bereitgestellt.

Anbieter ist:
Odoo SA
Belgien

Odoo bietet unter anderem eine Plattform zum Hosting von Odoo-Datenbanken und den damit verbundenen Anwendungen an.

In the context of the provision, Odoo may process personal data that arises particularly in the following operations:

Accessing our website
Using the contact form
Appointment booking
Using the live chat
Using the customer portal
Technical session and security management

As far as Odoo processes personal data within the purposes defined by us and according to our instructions, the processing is carried out as order processing.

Further information on processing by Odoo can be found in the Odoo privacy policy.

Personal data that we process within our Odoo database is stored only as long as necessary for the respective purpose or as long as legal retention obligations exist. For technical platform, backup, and log data processed by Odoo in the context of operations, the contractual and data protection regulations of Odoo also apply.

6. Cookies and comparable storage technologies

Our website uses cookies and comparable storage technologies, especially local storage.

Cookies are small text information that is stored in the browser and can be read again during later page visits. Information stored in local storage can be read by the website and used for certain functions.

We use technically necessary technologies as far as they are required for providing the website or a function explicitly requested by you. Optional technologies are only used with your prior consent.

The conditions of § 25 TDDDG apply to the storage of information on your device or access to it. The subsequent processing of personal data is based on the respective legal bases of the GDPR.

Details regarding names, purposes, categories, and durations of the technologies used can be found in our cookie policy.

Sie können Ihre Auswahl jederzeit über die Funktion„Meine Cookie-Einstellungen aktualisieren“ ändern. Ein Widerruf wirkt für die Zukunft.

7. Internal website evaluations

Odoo provides us with internal counts and evaluations for the use of our website as part of website management. We have not integrated Google Analytics, Google Tag Manager, Google Ads, Plausible Analytics, or any comparable external analysis service.

The internal evaluations serve the technical and content-related assessment of our web offering. As far as the information processed is personal data, the processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interests lie in the secure, economical, and needs-based operation as well as in the further development of our website.

We do not use the evaluations for personalized advertising or to create cross-provider usage profiles.

As far as personal data is involved in the evaluations, it will only be processed as long as necessary for the stated purposes. For technical data, over which we have no direct influence on storage, the contractual and data protection regulations of Odoo apply additionally.

8. Contact

You can contact us via the contact form on our website, by email, or by phone.

In doing so, we process the data you provide. This may include:

Name
Company
Email address
Phone number
Subject and content of your message
Time of contact
Other information you voluntarily provide

The processing serves to handle your request and the associated communication.

If your request relates to a potential or existing contract, the processing is based on Art. 6 para. 1 lit. b GDPR.

For other business or professional inquiries, the processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the proper handling and documentation of incoming inquiries.

The transmitted information may be stored in Odoo as a message, contact, or CRM process, as far as necessary for the processing and documentation of the request.

Mandatory fields are marked accordingly. Without the information marked as required, we may not be able to process your request.

We will delete the data when the request has been finally processed and no further business relationship exists. Legal retention obligations and the necessary storage for the assertion, exercise, or defense of legal claims remain unaffected.

9. Appointment Booking

You can book a conversation appointment through our website.

In this context, the following data may be processed:

Name
Email address
Phone number
Company
selected appointment
time zone
information about the purpose of the conversation
confirmation and communication data

The processing serves the selection, organization, confirmation, and execution of the appointment you requested.

To the extent that the appointment serves the preparation or execution of a contractual relationship, the legal basis is Art. 6 para. 1 lit. b GDPR.

In the case of general information or introductory conversations, the processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in efficient appointment planning and communication with interested parties, customers, and business partners.

The provision of the information marked as mandatory is required for online booking. Without this information, the appointment cannot be booked through the website.

Booking data will be deleted when they are no longer necessary for appointment organization and related communication. Legal retention obligations and necessary evidence of business communication remain unaffected.

10. Live Chat

Our website offers a live chat feature through which you can communicate with us in real time.

When using it, the following data may be processed:

Content of your chat messages
Date and time of the communication
Technical session data
Technical session and assignment data as well as, depending on your cookie selection, information related to the website areas accessed in connection with the chat function
Voluntarily provided contact and company data
If applicable, an assignment to an existing contact or CRM process

The processing serves to respond to your inquiry and for direct communication.

If your inquiry relates to a potential or existing contract, the legal basis is Art. 6 para. 1 lit. b GDPR.

For other inquiries, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in direct and efficient communication with interested parties, customers, and website visitors.

Chat histories are only stored as long as necessary for processing the inquiry, further business communication, or maintaining legitimate documentation interests. Legal retention obligations remain unaffected.

Cookies and local browser storage related to the live chat are described in our cookie policy.

11. Link tracking and UTM parameters

Wir können speziell gekennzeichnete Links verwenden, um festzustellen, über welche eigene Kommunikationsmaßnahme ein Besuch unserer Website erfolgt ist.

Solche Links können Angaben zu Kampagne, Quelle und Medium als Bestandteil der aufgerufenen Internetadresse enthalten. Odoo bezeichnet diese Angaben als UTM-Parameter und kann die Anzahl der Aufrufe eines gekennzeichneten Links statistisch darstellen.

Die Verarbeitung dient der Beurteilung der Reichweite unserer eigenen Kommunikationsmaßnahmen. Rechtsgrundlage für die Verarbeitung personenbezogener Daten ist Art. 6 Abs. 1 Buchst. f DSGVO. Unser berechtigtes Interesse liegt in der Bewertung und bedarfsgerechten Weiterentwicklung unserer Unternehmenskommunikation.

Wir verwenden die Funktion nicht für personalisierte Werbung oder eine anbieterübergreifende Verfolgung von Websitebesuchern.

Soweit im Zusammenhang mit dem Link-Tracking optional Informationen im Browser gespeichert oder aus diesem ausgelesen werden, erfolgt dies nur entsprechend Ihrer Cookie-Auswahl. Einzelheiten finden Sie in unserer Cookie-Richtlinie.

12. Customer portal and user accounts

Certain customers and business partners may use a secure customer portal.

For the setup and use of a portal access, the following data may be processed in particular:

Name and business contact details
Company and organizational affiliation
User ID
Authentication and session data
Portal permissions
Business and contract information provided via the portal
Technical log and security data

The processing serves to provide a secure access to the content and functions intended for the respective user.

The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the portal is used within the framework of a contractual relationship or pre-contractual measures.

Security-related processing is additionally based on Art. 6 para. 1 lit. f GDPR. Our legitimate interests lie in the protection of user accounts, business data, and IT systems.

The data required for registration must be provided if the portal is to be used.

Portal and user data are generally processed for the duration of the respective contractual or usage relationship. After the termination of the contractual or usage relationship, portal access will be deactivated as soon as there is no longer a legitimate purpose for use. Data will be deleted as soon as there are no legal retention obligations or other permissible reasons for further storage.

13. Protection against automated access with Cloudflare Turnstile

We use Cloudflare Turnstile to protect our website forms as well as the login, registration, and password reset functions of the customer portal from automated access, spam, and abuse.

Provider is:

Cloudflare, Inc.

United States of America

Turnstile führt technische Prüfungen der Browser- und Geräteumgebung durch, um menschliche Zugriffe von automatisierten Anfragen zu unterscheiden. Cloudflare nennt dabei unter anderem die IP-Adresse, den TLS-Fingerprint, den User-Agent-Header, den Sitekey und die Herkunft der Anfrage als verarbeitete Signal.

Cloudflare gibt an, dass Turnstile nicht auf Kommunikationsinhalte, Formulareingaben oder andere Eingaben auf der jeweiligen Seite zugreift.

Cloudflare processes the technical signals according to its own statements for the detection and blocking of bots as well as for improving bot detection. For the provision of the specific protection function, Cloudflare describes the processing as processing on behalf of the website operator.

The processing serves to protect our website, our forms, and our information technology systems from automated attacks and abusive inputs.

Rechtsgrundlage für die Verarbeitung personenbezogener Daten ist Art. 6 Abs. 1 Buchst. f DSGVO. Unsere berechtigten Interessen liegen in der IT-Sicherheit, der Verfügbarkeit unserer Dienste, der Vermeidung von Spam und dem Schutz unserer Kommunikations- und Geschäftssysteme.

As far as Turnstile stores information on your device or accesses information available there, the permissibility is additionally governed by § 25 TDDDG. More information about cookies and comparable storage technologies can be found in our Cookie Policy.

In the context of using Turnstile, processing of personal data outside the European Union or the European Economic Area cannot be excluded. Such transmission only takes place under the conditions of Art. 44 et seq. GDPR.

Weitere Informationen finden Sie im Turnstile-Datenschutznachtrag von Cloudflare.

We do not use Turnstile for advertising purposes and do not create our own user profiles based on the Turnstile check.

14. Recipients of personal data

Recipients of personal data may be, to the necessary extent:

the persons within our company entrusted with the respective processing,
Hosting- und Plattformdienstleister, insbesondere Odoo
IT and security service providers, especially Cloudflare in the context of Turnstile,
Kommunikationsdienstleister, soweit dies für den Versand und Empfang von Nachrichten oder Terminbestätigungen erforderlich ist

A transmission to authorities or external consultants only occurs if this is legally required, to fulfill our legal obligations, or if it is necessary for the assertion, exercise, or defense of legal claims.

Soweit Dienstleister personenbezogene Daten ausschließlich nach unserer Weisung verarbeiten, werden sie im Rahmen einer Auftragsverarbeitung eingesetzt.

15. Data transfers to third countries

When using service providers outside the European Union or the European Economic Area, personal data may be transferred to so-called third countries.

Such a transfer only occurs under the conditions of Art. 44 et seq. GDPR. If there is an applicable adequacy decision from the European Commission for the relevant third country or recipient, the transfer can be based on Art. 45 GDPR. Otherwise, we use, as necessary, appropriate safeguards according to Art. 46 GDPR, in particular the standard contractual clauses of the European Commission.

Information on specific third country transfers can also be found in the sections regarding the respective service providers. You can request a copy or further information about the safeguards used at the contact details mentioned in section 1.

16. Storage duration

We only store personal data as long as this is necessary for the respective processing purpose.

Any further storage occurs particularly if:

there are legal retention obligations,
data is needed for the assertion, exercise, or defense of legal claims,
a security-related incident needs to be investigated,
a contractual, customer, or portal relationship continues,
a valid consent allows further processing.

After the purpose of processing has ceased and the existing retention periods have expired, personal data will be deleted. If deletion is not technically possible immediately, processing will be limited to the existing retention purposes until deletion.

17. Provision of personal data

Unless otherwise specified in the respective processing operation, there is no legal obligation to provide personal data. For contractual services, the provision of certain data may be necessary for us to fulfill the contract or provide the desired function.

However, for contact inquiries, appointment bookings, and portal access, the information marked as required must be provided. Without this data, we may not be able to process or provide the desired inquiry, booking, or function.

18. Automated decision-making

We do not use exclusively automated decision-making in the context of the described website functions as defined in Art. 22 GDPR, which has legal effects on you or significantly affects you in a similar manner.

The automated technical check by Cloudflare Turnstile serves to detect and prevent abusive or automated access as well as to further develop bot detection by Cloudflare. It does not have legal effects on website visitors and does not significantly affect website visitors in a comparable manner. Therefore, in our assessment, it does not constitute an automated decision within the meaning of Art. 22 GDPR.

We do not create profiles for the purposes of personalized advertising.

19. Data security

We take appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized alteration, disclosure, or unauthorized access.

Data transmission between your browser and our website is encrypted via HTTPS. Access to administrative functions and the customer portal is protected by authentication and authorization mechanisms.

Our security measures are reviewed and adjusted according to technical developments and the respective risks.

19. Ihre Datenschutzrechte

You have the right, subject to legal requirements, in particular:

to request information about the personal data we process in accordance with Art. 15 GDPR,
to request the correction of inaccurate or the completion of incomplete data in accordance with Art. 16 GDPR,
to request the deletion of your personal data in accordance with Art. 17 GDPR,
to request the restriction of processing in accordance with Art. 18 GDPR,
to receive the personal data you provided under the legal requirements in a structured, commonly used, and machine-readable format or to request its transfer to another controller in accordance with Art. 20 GDPR,
to object to certain processing in accordance with Art. 21 GDPR,
to revoke any consent given at any time with effect for the future in accordance with Art. 7 (3) GDPR,
to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR.

To exercise your rights, you can contact the contact details mentioned in section 1.

20. Widerspruchsrecht

As far as we process personal data based on Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation.

We will no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

22. Withdrawal of Consents

You can withdraw your consent at any time with effect for the future.

The lawfulness of processing based on the consent until the withdrawal is not affected by the withdrawal.

You can change your cookie selection via the "Update My Cookie Settings" function on the page Cookie Policy.

23. Right to Complain

Sie haben das Recht, sich bei einer Datenschutzaufsichtsbehörde zu beschweren.

Für die Next Scientific GmbH ist grundsätzlich folgende Aufsichtsbehörde zuständig:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Telefon: +49 211 38424-0
E-Mail: poststelle@ldi.nrw.de

Informationen zur Kontaktaufnahme und zum Beschwerdeverfahren finden Sie auf der Website der LDI Nordrhein-Westfalen.

24. Changes to this Privacy Policy

We update this privacy policy when legal requirements, our website functions, service providers used, or technical processes change.

The version published on this website applies.

As of: September 2026