Skip to main content

Privacy Policy

Protecting your personal data on ndy.onl

1. Controller (Responsible Entity)

The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:

C4NDY Digital UG (haftungsbeschränkt)
Hauptstr. 34, 89284 Pfaffenhofen a. d. Roth, Germany
Represented by Managing Director: Mr. Adrian Jehne
Phone: +49 (0) 7302 – 7090979
Email: info@ndy.onl

2. Your Rights as a Data Subject

Using the contact details provided above, you may exercise the following rights under the GDPR at any time:

  • Access to your personal data stored by us and information on its processing (Art. 15 GDPR),
  • Rectification of inaccurate personal data (Art. 16 GDPR),
  • Erasure of your personal data stored by us (Art. 17 GDPR),
  • Restriction of processing where we are not yet permitted to delete your data due to statutory retention obligations (Art. 18 GDPR),
  • Objection to the processing of your data by us (Art. 21 GDPR),
  • Data portability, provided you have consented to the data processing or entered into a contract with us (Art. 20 GDPR).

If you have given us your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR).

Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR):
You have the right to lodge a complaint with a data protection supervisory authority at any time. The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

3. Hosting on Our Own Infrastructure in Bavaria

Our application servers, databases, email systems, and all client systems (ndy.Cloud, ndy.ERP) are operated exclusively on our own hardware at our server facility in Pfaffenhofen a. d. Roth (Bavaria, Germany). No application or customer database data is stored with external cloud hosting providers.

4. Content Delivery Network & DDoS Protection (Cloudflare)

To protect our self-hosted server infrastructure against Distributed Denial of Service (DDoS) attacks and malicious bot traffic, and to ensure secure and reliable delivery of this website, we use the reverse proxy and Content Delivery Network (CDN) service provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (and Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany).

All traffic between your browser and our website is routed through the Cloudflare network, inspected for malicious attack patterns, and forwarded via encrypted connection to our servers in Pfaffenhofen a. d. Roth. In doing so, Cloudflare processes technically required connection metadata (in particular your IP address, requested URL, timestamp, HTTP headers, and security fingerprints for threat mitigation).

  • Legal Basis: The use of Cloudflare is based on our legitimate interest in the secure, resilient, and efficient provision of our online services and defense against cyberattacks (Art. 6 (1) (f) GDPR).
  • International Transfers & Safeguards: Cloudflare Inc. is certified under the EU-US Data Privacy Framework (DPF), meaning transfers to the United States are covered by an adequacy decision of the European Commission pursuant to Art. 45 GDPR. In addition, we have concluded a Data Processing Addendum (Art. 28 GDPR) including the EU Standard Contractual Clauses with Cloudflare. Further details can be found in Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.

5. Collection of General Information (Server Log Files)

When you access our website, general technical information is automatically recorded in our server log files. This includes the browser type, operating system, referrer URL, IP address, and timestamp/status of the request.

This data is processed for the following purposes (legal basis: Art. 6 (1) (f) GDPR):

  • Ensuring trouble-free connection setup and smooth use of the website,
  • Evaluating system security and stability as well as error diagnostics.

IP addresses in our server log files are anonymized or deleted after a maximum of 14 days.

6. Cookies & Local Storage

We only use technically necessary storage mechanisms on our website (such as storing your selected language or light/dark theme preference, and security-relevant Cloudflare bot-protection tokens pursuant to § 25 (2) No. 2 TDDDG). We do not use third-party advertising or tracking cookies.

7. Contact via Email or Telephone

If you contact us by email or telephone, the information you provide (e.g., name, email address, phone number, message content) will be stored exclusively on our own hardware in Pfaffenhofen for the purpose of processing your inquiry and possible follow-up questions.

  • Legal Basis: Art. 6 (1) (b) GDPR (pre-contractual measures or performance of a contract) and Art. 6 (1) (f) GDPR (legitimate interest in responding to business inquiries).

8. TLS/SSL Encryption

To protect the security of your data during transmission, we use state-of-the-art transport encryption (TLS/HTTPS).

9. Web Analytics with Umami (Cookie-Free, Self-Hosted)

For statistical evaluation of visitor access, we use the open-source analytics tool Umami. Umami is operated exclusively on our own hardware in Pfaffenhofen a. d. Roth.

Umami uses no cookies, stores no personal data, and creates no user profiles. IP addresses are not stored in plain text and there is no cross-site tracking. The anonymized metrics are never shared with third parties. Processing is based on our legitimate interest in the statistical analysis and optimization of our website (Art. 6 (1) (f) GDPR).

10. Updates to This Privacy Policy

We reserve the right to update this privacy policy so that it always complies with current legal requirements or to reflect changes to our services.

Status: November 2026