Privacy Policy of Nivaro Aircraft

Last updated: 25 September 2026

1. Privacy at a Glance

1.1 General Information

This Privacy Policy explains which personal data we process when you visit nivaro-aircraft.com or contact us, the purposes for which we process that data, and the rights available to you.

Personal data is any information that can be used to identify you personally.

1.2 Who Is Responsible for Processing Your Data?

The controller responsible for processing your personal data is Nivaro Aircraft GbR. Full contact details are provided in Section 2 of this Privacy Policy.

1.3 How Do We Collect Your Data?

We receive certain data directly from you, for example when you use our contact form, contact us by email or telephone, select a language, or voluntarily save a partner referral.

Other technical data is generated when you visit the website and is processed to provide and secure the website. This includes, in particular, your IP address and technical HTTP information.

We also use Cloudflare Web Analytics for statistical analysis and to measure actual website performance. Further information, including how to disable Web Analytics for your browser, is provided in Section 7.

1.4 What Do We Use Your Data For?

We process data in particular:

  • to provide and secure the website;
  • to handle contact requests and enquiries relating to contracts;
  • to remember the language you have expressly selected;
  • to provide voluntary partner referral attribution;
  • to perform statistical analysis and technically optimise the website.

The relevant data, purposes and legal bases are described in detail in the following sections.

1.5 What Rights Do You Have?

Subject to the requirements of the GDPR, you have rights including access, rectification, erasure, restriction of processing and data portability.

You may withdraw consent with effect for the future. You may object to certain processing based on legitimate interests. You also have the right to lodge a complaint with a data protection supervisory authority.

Further information is provided in Section 9.

2. Controller

Nivaro Aircraft GbR

Partners: Nico Fritzsche and Yven Felsch

Brünhildestraße 13

14542 Werder (Havel), Germany

Telephone: +49 1523 1971296

Email: privacy@nivaro-aircraft.com

You may send privacy-related enquiries to the email address above. No data protection officer has been appointed.

3. Provision and Security of the Website

3.1 Website Delivery via Cloudflare

We use Cloudflare Workers and Workers Static Assets provided by Cloudflare to deliver static pages and public website assets. When you access the website, your IP address, the requested address, the time of the request and technical HTTP information are processed in particular. We cannot deliver the requested page without this data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide a functional, accessible and secure website.

3.2 Security Measures and Security Analytics

Cloudflare Managed WAF, HTTP DDoS Protection and Browser Integrity Check inspect requests for attacks and misuse; affected requests may be blocked.

Security Analytics helps us identify and investigate security-related events. In particular, this involves processing the source IP address, device type, operating system, browser, country, HTTP method and version, cache status and time of the request.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the security and availability of the website.

Security Analytics data is available to us for up to seven days and Security Events for up to 24 hours.

3.3 Protection of the Contact Form

We use Cloudflare Workers Rate Limiting for the contact form. The IP address is processed to identify and limit automated or abusive requests.

Our application code does not store the IP address for this purpose in the referral database or include it in the contact email. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to protect the contact form and the systems connected to it.

Technical request data may also be generated for website delivery and security checks even if you do not submit a contact request.

3.4 Retention of Technical Cloudflare Data

Cloudflare also processes technical operational, request and security data to provide and secure its services.

There is no single product-specific retention period that applies to all such Cloudflare-internal data. Retention depends on the respective technical and security purpose and on applicable contractual and legal requirements.

4. Language Settings and Cookies

4.1 Automatic Language Selection

When you first access the website, we may evaluate the Accept-Language value transmitted by your browser to select the appropriate German or English version and, where applicable, redirect you to it.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide the website in a language that is understandable to you.

4.2 Remembering Your Language Selection

If you select a language yourself, we store that selection for future visits in the nivaro-locale cookie.

It contains only de or en, applies to the entire website (Path=/), uses SameSite=Lax and expires after 365 days. The website remains usable without this cookie.

We rely on Section 25(2) no. 2 TDDDG for storing and accessing your selected language. To the extent that personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to retain the language you have expressly selected for subsequent visits.

4.3 Other Cookies

The cookies used for voluntary partner referral attribution and for your objection to Web Analytics are described in Sections 6 and 7.

5. Contact Form, Email and Telephone

5.1 Data Processed Through the Contact Form

When you submit the contact form, we process the type of enquiry, your name, email address, telephone number and message. We also process your confirmation that you have acknowledged the Privacy Policy; this confirmation does not constitute consent to the processing necessary to handle your enquiry.

You may voluntarily provide information about a partner or intermediary. Depending on the nature of your enquiry, an aircraft reference and aircraft ID may also be included.

We also process your selected language, a request identifier, any applicable referral context and technical information used to detect automated or abusive submissions. Your IP address is used for the rate limiting described above.

We require the mandatory information to categorise and understand your enquiry and to contact you. Without this information, the form cannot be submitted and your enquiry cannot be handled through the form. Optional information is not required for a general enquiry.

Where your enquiry concerns a contract with you or pre-contractual measures taken at your request, the legal basis is Art. 6(1)(b) GDPR.

We process other enquiries on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries addressed to us.

Technical measures to prevent misuse are based on Art. 6(1)(f) GDPR.

5.3 Transmission and Email Processing

The message is transmitted via Cloudflare Email Service to the mailbox designated for website enquiries and is processed in our mailboxes hosted by mailbox.org, operated by Heinlein Hosting GmbH, Berlin.

Internal forwarding takes place only to other mailbox.org mailboxes used by us. The website code does not automatically transmit personal contact details to referral partners.

Under our current process, contact requests are not disclosed to other third parties; the service providers identified above process data on our behalf in order to provide their services.

5.4 Retention and Deletion

We delete spam and clearly irrelevant messages promptly.

We retain ordinary enquiries while they are being handled and generally for no longer than twelve months after the matter has been concluded. We review data for deletion monthly. This also applies to our internal mailbox.org mailboxes and archives.

We retain data for longer only where this is necessary in connection with an ongoing business matter, for the establishment, exercise or defence of legal claims, or due to an applicable statutory retention obligation.

Correspondence that is subject to commercial or tax-law retention requirements is retained for the applicable statutory period. Not every contact request is subject to such a retention obligation.

5.5 Direct Contact by Email or Telephone

If you contact us directly by email or telephone, we process the contact details you provide and any other information arising from your enquiry. We use this data to handle your request and respond to any necessary follow-up questions.

Where your enquiry concerns a contract with you or pre-contractual measures taken at your request, the legal basis is Art. 6(1)(b) GDPR. We process other enquiries on the basis of Art. 6(1)(f) GDPR; our legitimate interest is to handle enquiries addressed to us.

For messages received by email, the retention and deletion principles described in Section 5.4 apply accordingly. For telephone enquiries, we store personal data only to the extent that it is documented as necessary to handle the relevant matter.

6. Voluntary Partner Referrals and Attribution

If you access the website through a partner link, you may consent to being automatically attributed to that partner.

Only after you have given your consent do we set the __Host-nivaro-referral cookie. It contains the partner identifier, a random consent identifier and timing and expiry information. Its active lifetime is 365 days.

The storage and access of this cookie are based on your consent under Section 25(1) TDDDG; the associated automatic attribution is based on Art. 6(1)(a) GDPR.

You can use the website and contact form without giving this consent.

You may withdraw your referral consent at any time with effect for the future using the withdrawal function in this Privacy Policy. The referral cookie will then be deleted.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Data relating to enquiries already received may be retained only where there is a separate legal basis for doing so.

To demonstrate that consent was given, we store the consent identifier, the language and text version referral-v1, and the relevant decision, expiry and, where applicable, withdrawal timestamps.

We delete this evidence 36 calendar months after the consent ends.

The necessary documentation of consent is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. To the extent that additional retention is necessary for the establishment, exercise or defence of legal claims, the legal basis is Art. 6(1)(f) GDPR.

6.4 Pseudonymous Partner Attribution

For enquiries with a relevant referral or partner connection, we store a pseudonymous enquiry and attribution history in Cloudflare D1.

This includes a pseudonymous key derived from the email address, partner codes, roles, the source and status of the attribution, request identifiers and timestamps.

Your name, email address in plain text, telephone number and message text are not stored as referral data in D1.

If there is no relevant referral or partner signal and no existing active primary attribution, we do not create such a history record. The data remains pseudonymous but may still be attributable to an individual by us in connection with an enquiry.

6.5 Lead Protection and Retention

Automatic attribution based on the referral cookie relies on your consent under Art. 6(1)(a) GDPR.

Where necessary, we separately rely on Art. 6(1)(f) GDPR for documenting and administering a relevant partner attribution after an enquiry has been received, preventing conflicting attributions, and implementing the contractually agreed lead protection arrangements with the partner. Our legitimate interest is the transparent and fair administration of our partner programme.

A primary attribution remains active for 365 days and is then retained for a further six calendar months as a historical record. Relevant contact histories are retained for six calendar months from the respective enquiry. The data is automatically deleted thereafter.

6.6 Storage in Cloudflare D1

The D1 database used for this attribution uses Cloudflare’s EU Jurisdiction. According to Cloudflare’s product information, this means that the database is operated and stored within the EU.

This does not constitute a general restriction of all Cloudflare processing to the EU.

The website system does not automatically disclose personal enquiry data to the partner.

7. Cloudflare Web Analytics and Your Right to Object

7.1 Purpose of Web Analytics

We use Cloudflare Web Analytics with Real User Measurements on nivaro-aircraft.com. Cloudflare automatically inserts the JavaScript beacon when delivering the website.

This enables us to measure page views, actual loading times and Core Web Vitals, identify performance issues, and improve stability, content and user experience.

7.2 Data Processed

The beacon processes, in particular, page and path information, referrer information, browser and device information, performance metrics and an identifier for the individual page view.

When receiving the beacon request, Cloudflare also technically receives the source IP address. According to Cloudflare, the IP address is discarded at an early stage at the nearest data centre and is not stored in Web Analytics core databases or logs.

According to Cloudflare, the beacon does not set analytics cookies, does not use localStorage, sessionStorage or IndexedDB, and does not recognise visitors over the long term based on their IP address or User-Agent.

Personal data may nevertheless be processed temporarily.

We rely on Art. 6(1)(f) GDPR for this processing.

Our legitimate interest is the data-minimising statistical analysis and technical optimisation of our online service, in particular measuring real-world performance, identifying technical issues, and improving loading times, Core Web Vitals, stability and user experience.

Providing your data for these purposes is neither legally nor contractually required; the website can also be used without Web Analytics.

7.4 Disabling and Re-enabling Web Analytics

Disable Web Analytics for this browser: You can use the objection function in this Privacy Policy to disable web analytics directly and re-enable it later.

After you make your selection, the page will reload completely. When you disable Web Analytics, we set only the __Host-nivaro-analytics-optout=1 cookie with a lifetime of 365 days, Secure, SameSite=Lax and Path=/. It does not contain a visitor identifier.

Cloudflare recognises this cookie and does not insert the Web Analytics beacon on subsequent page views made with this browser.

When you re-enable Web Analytics, we delete the cookie; Web Analytics becomes active again after the page reloads. Processing that took place before you opted out is not reversed.

You may also contact us at privacy@nivaro-aircraft.com.

The opt-out cookie stores only your decision to suppress web analytics.

Storing and accessing this cookie is necessary to provide the objection function you have requested within the meaning of Section 25(2) no. 2 TDDDG.

To the extent that personal data is processed in implementing your choice, this serves to comply with your objection under Art. 21 GDPR (Art. 6(1)(c) GDPR) or our legitimate interest in reliably respecting your privacy preference (Art. 6(1)(f) GDPR).

The cookie does not store any additional identifier.

7.6 Retention

According to Cloudflare’s product information, unsampled beacon data is retained for seven days. The data is then reduced for longer-term analysis.

Analytics for the previous six months are available in the Web Analytics dashboard.

8. Service Providers and Processing Outside the EEA

8.1 Cloudflare

Cloudflare, Inc., USA, provides the infrastructure, security, email, database and Web Analytics services described above and uses published subprocessors.

To the extent that Cloudflare processes personal data on our behalf, the Cloudflare DPA incorporated into the Self-Serve Subscription Agreement applies.

8.2 mailbox.org

We use mailbox.org, operated by Heinlein Hosting GmbH, Berlin, for our email mailboxes under a data processing agreement.

According to the provider, mailbox.org operates the email services we use in data centres in Berlin. We are currently not aware of any transfer to a third country in connection with its regular processing.

8.3 Processing Outside the EEA

Cloudflare may process personal data outside the European Economic Area or permit access to such data from outside the EEA.

Our account is not configured with a general restriction requiring all Cloudflare metadata and logs to remain within the EU.

For transfers classified as a “Restricted Transfer” under the Cloudflare DPA, the DPA provides for the European Commission’s Standard Contractual Clauses and supplementary measures.

For applicable transfers to the United States, Cloudflare also relies on the EU-U.S. Data Privacy Framework. The adequacy effect of that framework depends on the relevant recipient maintaining a valid certification.

You may contact us using the details above for further information about the applicable safeguards and to request a copy of the Standard Contractual Clauses.

9. Your Rights

9.1 Data Subject Rights

Subject to the requirements of the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Partner referrals: You may withdraw your consent to automatic partner attribution at any time using the withdrawal function in Section 6. The __Host-nivaro-referral cookie will then be deleted and consent-based automatic partner attribution will cease for the future. Data relating to enquiries already received may be retained only where there is a separate legal basis for doing so.

Where processing is based on Art. 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation (Art. 21(1) GDPR).

Web Analytics: You can exercise your right to object to Cloudflare Web Analytics directly using the objection function in Section 7. The setting applies to the relevant browser and can be changed again later.

To exercise your other data protection rights, you may contact us at privacy@nivaro-aircraft.com.

9.3 Right to Object to Direct Marketing

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing.

Following your objection, your personal data will no longer be processed for these purposes (Art. 21(2) and (3) GDPR).

9.4 Right to Lodge a Complaint and Automated Decision-Making

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

We do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you in connection with the website processing described in this Privacy Policy.