Privacy
Policy.

Privacy at a Glance

This privacy policy informs you about the nature, scope, and purpose of the collection and use of personal data on our website nxs.digital and within our SaaS platform NEXUS V2. The responsible entity is Broos Project GmbH (see legal notice for details).

Responsible Party

Data Collection on Our Website

Server Log Files

Each time our website is accessed, information is automatically collected that your browser transmits: IP address, date and time of the request, page accessed, HTTP status code, data volume transferred, referrer URL, browser and operating system. This data is used exclusively to ensure operation and system security (legal basis: Art. 6 Para. 1 lit. f GDPR). It is not merged with other data sources.

Contact Form

When you contact us via the contact form, your information (name, email address, company, message) will be processed for handling your inquiry and forwarded to us by email. Email delivery is handled by Resend (Resend Inc., EU region). This data will not be shared with third parties. Legal basis: Art. 6 Para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 Para. 1 lit. f GDPR (legitimate interest in responding to inquiries).

Infrastructure: Google Firebase & App Hosting

Our platform uses Google Firebase for authentication (Firebase Authentication), database (Cloud Firestore), and file storage (Cloud Storage). All data is stored in the EU (database region europe-west3, Frankfurt am Main).

Application hosting is provided via Google App Hosting (region europe-west4, Netherlands). Server log files (IP addresses, access times, requested pages) may be processed as part of hosting.

Google LLC is certified under the EU-US Data Privacy Framework and has concluded Standard Contractual Clauses (SCCs). For more information: policies.google.com/privacy

Error Monitoring: Sentry

We use Sentry (Functional Software Inc. dba Sentry, EU region Frankfurt) for the detection and diagnosis of technical errors. Sentry captures anonymised error messages, stack traces, and technical device data. All text fields, input fields, and media content are masked — no content (messages, form data) is transmitted to Sentry. IP addresses are not forwarded (sendDefaultPii: false). Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in error-free operation).

Cookies

Our website uses exclusively technically necessary cookies that are required for operation (e.g. session cookies for authentication). These cookies are automatically deleted at the end of your browser session. Consent is not required for technically necessary cookies pursuant to § 25 Para. 2 TDDDG. Analytics, advertising, or tracking cookies are not used.

Data Processing in the Platform (Data Processing Agreement)

In the context of using NEXUS V2, we process personal data on behalf of our business clients (data processing agreement pursuant to Art. 28 GDPR). The respective business client as controller is responsible for the lawfulness of this processing. Data is stored separately per tenant and is accessible exclusively to authorised users of the respective tenant. Categories of processed data: employee master and employment data, time recording data (incl. GPS location on clock-in/out), project data, financial data, and documents. All data is stored in the EU (Firestore region europe-west3, Frankfurt).

Your Rights as a Data Subject

Under the GDPR, you have the following rights against Broos Project GmbH as the responsible party:

• —Access to your stored data (Art. 15 GDPR)
• —Rectification of inaccurate data (Art. 16 GDPR)
• —Erasure of your data, unless statutory retention obligations apply (Art. 17 GDPR)
• —Restriction of processing (Art. 18 GDPR)
• —Data portability (Art. 20 GDPR)
• —Objection to processing (Art. 21 GDPR)

To exercise your rights, please contact: buero@broos-project.de

Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR). The competent authority for Broos Project GmbH is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, www.ldi.nrw.de

Data Security

We implement technical and organisational security measures pursuant to Art. 32 GDPR. These include: AES-256 encryption of data at rest, TLS 1.2+ encryption in transit, role-based access control (RBAC), complete tenant-based data separation, and monthly data backups. A detailed description of our measures is available in our TOMs document upon request.