Privacy notice

Last updated 22 October 2026

This notice explains what personal data is processed when you visit nepsion.com or write to us, why, and what rights you have under the General Data Protection Regulation (GDPR).

Who is responsible

The controller under Art. 4(7) GDPR is:

Nepsion is a company in formation. Once the company is registered, it will take over this role and this notice will be updated.

What this website does not do

This website sets no cookies and uses no analytics, tracking pixels, advertising or social media plugins. It loads no content from other providers: the fonts are served from our own website. We do not store or read any information on your device, so no consent under § 25 TDDDG is needed.

Visiting the website

Our website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you open a page, your browser automatically sends technical information that Netlify needs to deliver it:

• your IP address
• the date and time of the request
• the page or file requested and whether the request succeeded
• the amount of data transferred
• the website you came from, if your browser sends it
• your browser type and operating system

Purpose: to deliver the website, keep it stable and secure, and detect and defend against attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a website that works and is secure. Without this data, the website cannot be delivered to you.

Recipient: Netlify processes this data on our behalf under a data processing agreement (Art. 28 GDPR). We do not download, combine or analyse these logs.

Transfers outside the EU: Netlify serves the website through a global network of servers, so the data may be processed in the United States and other countries. Netlify, Inc. participates in the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing adequate protection (Art. 45 GDPR). For transfers to other countries, Netlify relies on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Storage period: Netlify keeps this data only for as long as needed for the purposes above, in line with its data processing agreement with us.

Writing to us by email

When you email us, we process your email address, your name if you give it, and the content of your message.

Purpose: to answer your message and follow up on it.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract with us or steps before one, for example a pilot or partnership. Otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering the messages we receive.

Recipient: our email is hosted with Google Workspace, provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google stores and delivers our email on our behalf under its Cloud Data Processing Addendum (Art. 28 GDPR).

Transfers outside the EU: Google may process email data outside the EU, including in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework (Art. 45 GDPR). For other transfers, Google relies on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Storage period: we delete your messages once the conversation is finished and no further steps are expected, unless a statutory retention period under commercial or tax law requires us to keep them longer.

Standard email is not end-to-end encrypted. Please do not send sensitive information by email. If you need to, write to us first and we will agree a secure channel.

Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• have processing restricted (Art. 18 GDPR)
• receive your data in a portable format (Art. 20 GDPR)

To use any of these rights, write to contact@nepsion.com.

Your right to object

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing your data unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Your right to complain

You can complain to any data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Automated decisions

We do not make automated decisions or create profiles based on your data.

Changes to this notice

We update this notice when our website or our company changes. The current version is always on this page.