Privacy Policy: Helm & Nagel

This privacy policy explains how Helm & Nagel GmbH collects and processes personal information when you visit helm-nagel.com. We are committed to transparency and minimal collection. This site does not use tracking cookies, analytics software, or advertising networks. To learn more about our company values and approach to data protection, visit our about page.

Controller

The responsible party under Art. 4(7) GDPR is:

Helm & Nagel GmbH Rosenweg 5 35614 Aßlar, Deutschland

Phone: 01633314960 Email: info@helm-nagel.com

For full company registration details, see our imprint.

How This Site Works

helm-nagel.com is a static website. There is no server-side application, no database, and no user accounts. Pages are pre-built HTML files served by GitHub Pages. This architecture ensures minimal data exposure and reduces privacy risks inherent in dynamic applications. No cookies are set by this site, and no visitor tracking takes place.

All JavaScript on the site is first-party code served from the same domain. No third-party analytics scripts (such as Google Analytics or similar services) are loaded. This means we do not monitor your browsing patterns, session duration, or behavior on our site. You remain completely anonymous when visiting. All functionality relies only on scripts and styles loaded directly from our domain to enhance user experience without surveillance.

Information We Collect

Server Access Logs

When you visit this site, the hosting provider (GitHub Pages) may collect standard server log entries. These typically include:

• Your IP address
• Browser type and version
• Operating system
• Referring URL
• Pages requested and time of access

This logging is performed by the hosting infrastructure and is outside our direct control. GitHub's own privacy statement governs how they handle this information. We do not access or analyse these logs.

Legal basis: Legitimate interest in providing a functional website (Art. 6(1)(f) GDPR).

Contact Form

Our contact page provides a form for reaching us. When you submit it, your name, email address, and message are transmitted to the service submit-form.com, which forwards the submission to us by email. Submit-form.com acts as a processor on our behalf.

We do not store your submission on the website itself. The forwarded email is retained in our mailbox for as long as necessary to respond to your inquiry and fulfil any resulting business relationship, or until you request deletion.

The contact form uses Botpoison for spam protection. Botpoison analyses browser signals to distinguish humans from bots. It does not set cookies or collect personal information beyond what is needed for the spam check.

Legal basis: Your consent by submitting the form, and our legitimate interest in responding to inquiries (Art. 6(1)(a) and (f) GDPR).

Email and Phone Contact

If you reach us by email or phone, we store the information you provide (name, email address, phone number, message content) solely to handle your request. This information is deleted once your inquiry is fully resolved and no legal retention obligations apply.

Legal basis: Legitimate interest in handling business communications (Art. 6(1)(f) GDPR), or performance of a pre-contractual measure at your request (Art. 6(1)(b) GDPR).

Third-Party Services

GitHub Pages (Hosting)

This site is hosted on GitHub Pages, a service of GitHub, Inc. (88 Colin P Kelly Jr St, San Francisco, CA 94107, USA). GitHub may process IP addresses and request metadata as part of delivering the site. GitHub is certified under the EU-US Data Privacy Framework.

More information: GitHub Privacy Statement

submit-form.com (Contact Form Processing)

Contact form submissions are routed through submit-form.com. This service receives the form contents and forwards them to our email. It does not retain your submission beyond the time needed for delivery.

Botpoison (Spam Protection)

The contact form loads a small script from Botpoison to prevent automated spam. Botpoison performs a browser-based challenge without CAPTCHAs or cookies. No personal information is stored by Botpoison.

YouTube (Embedded Videos)

Some pages embed YouTube videos using privacy-enhanced mode (youtube-nocookie.com). Videos are not loaded automatically. Instead, only a locally hosted thumbnail image is shown. The YouTube iframe and its cookies are loaded only when you actively click to play the video. Until you click, no connection to YouTube servers is established and no cookies are set.

Once you click play, YouTube may set cookies and collect usage information. YouTube is operated by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland).

More information: Google Privacy Policy

Legal basis: Your consent by clicking to play the video (Art. 6(1)(a) GDPR).

Cookies

This site does not set any cookies. No first-party cookies, no analytics cookies, and no advertising cookies are used. A cookie consent banner is therefore not required.

Cookies may be set by YouTube if you choose to play an embedded video (see above). These are governed by Google's privacy policy.

Retention Periods

We retain personal information only as long as necessary for the purpose it was collected:

• Contact form submissions and emails: Deleted after your inquiry is resolved, unless legal retention periods apply (up to 6 years for commercial correspondence under German tax law, Section 147 AO).
• Server logs: Controlled by GitHub; we do not access or store them separately.
• YouTube interaction: Governed by Google's retention policies.

Your Rights Under the GDPR

You have the following rights regarding your personal information. To exercise any of them, contact us at info@helm-nagel.com.

• Access (Art. 15): Request confirmation of whether we process your personal information and obtain a copy.
• Rectification (Art. 16): Request correction of inaccurate information we hold about you.
• Erasure (Art. 17): Request deletion when the original purpose no longer applies, you withdraw consent, or the processing was unlawful.
• Restriction (Art. 18): Request that we limit processing while a dispute about accuracy or lawfulness is resolved.
• Portability (Art. 20): Where processing is based on consent or contract, request your information in a structured, machine-readable format.
• Object (Art. 21): Object to processing based on legitimate interest. We will stop unless we demonstrate compelling grounds that override your interests.
• Withdraw consent (Art. 7(3)): Where processing is based on your consent, withdraw it at any time. Withdrawal does not affect the lawfulness of earlier processing.

Supervisory Authority

You also have the right to lodge a complaint with a supervisory authority. The responsible authority for Hessen is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Postfach 3163, 65021 Wiesbaden Phone: +49 611 1408-0 Website: datenschutz.hessen.de

Transfers to Third Countries

GitHub Pages and Botpoison are operated by US-based companies. Transfers to the USA are covered by the EU-US Data Privacy Framework or standard contractual clauses. YouTube transfers are governed by Google's data processing agreements.

Changes to This Policy

We may update this privacy policy to reflect changes in our services or legal requirements. The current version is always available at this URL.

Last updated: March 2026