Privacy policy

1. Privacy at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit this website or use Nexxus Pilot in the browser or as an app. Personal data is any data that can be used to identify you personally. You will find detailed information in the sections below.

Who is responsible for the data processing?

The operator of Nexxus Pilot is responsible. The name and address are given in the section “Controller”.

How do we collect your data?

You provide some of the data yourself, such as your email address when you sign in or the securities in your portfolio. Our systems collect other data for technical reasons when you access the service, such as your IP address or the time of access.

What do we use your data for?

We use your data to provide Nexxus Pilot to you: your portfolio, your watchlist, your alerts and the notifications that go with them. We do not evaluate your usage for advertising purposes, do not use any analytics or advertising services and do not sell any data.

What rights do you have?

You have the right at any time to information about the origin, recipients and purpose of your stored personal data. You can also request correction, deletion or restriction of processing, object to processing and receive your data in a common format. You can withdraw consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority. Details are given in section 3.

2. Controller

The controller for data processing at Nexxus Pilot is:

Phillip Kracht, c/o Impressumservice Dein-Impressum, Stettiner Straße 41, 35410 Hungen, Germany. Phone: 01579-2341672. Email: impressum@nexxuspilot.com

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data. We have not appointed a data protection officer because we are not required to do so. Please send questions about data protection to the email address above.

3. Your rights

Access, correction and deletion

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing. Where applicable, you also have a right to have this data corrected or deleted (Articles 15 to 17 GDPR).

You can delete your account yourself at any time: in your profile in the app or on the website, under “Delete account”. We then delete your data in Nexxus Pilot immediately. Alternatively, you can send us an email from the address you use to sign in. In that case we delete your data without undue delay, within one month at the latest. Your Nexxus ID account is your sign-in for all Nexxus apps. Nexxus Pilot cannot delete it itself. If you wish, we request its deletion for you. This is usually done within 7 days. You then receive a confirmation. Otherwise the account remains. You can delete it at any time at nexxus.group/id. Cancellations you submitted via the “Cancel contracts here” page are kept as proof, without any link to your account. Data that we must retain for tax or commercial law reasons is deleted once these retention periods have expired.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data (Article 18 GDPR). This right applies in the following cases:

• If you dispute the accuracy of your data stored with us, for the duration of our review.
• If the processing was or is unlawful and you request restriction instead of deletion.
• If we no longer need the data but you need it to exercise, defend or assert legal claims.
• If you have lodged an objection under Article 21(1) GDPR, as long as it has not yet been determined whether our interests prevail.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format (Article 20 GDPR). You can export your portfolio and your watchlist as a file yourself at any time.

Withdrawal of your consent

Some processing is based on your consent, such as push notifications. You can withdraw consent at any time. For push notifications you can also do so in the settings of your device or browser. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Article 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH A PROCESSING OPERATION IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ASSERTION, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING (OBJECTION UNDER ARTICLE 21(2) GDPR). WE DO NOT CURRENTLY CARRY OUT ANY DIRECT MARKETING.

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.

Objection to promotional emails

We hereby object to the use of the contact details published in the legal notice for sending advertising and information material that has not been expressly requested.

4. General information

Legal bases

If you have given consent, we process your data on the basis of Article 6(1)(a) GDPR. If the consent concerns access to your device, we additionally rely on Section 25(1) TDDDG. If your data is necessary to perform the user agreement or to carry out pre-contractual measures, we process it on the basis of Article 6(1)(b) GDPR. To fulfil legal obligations, such as tax retention obligations, we process it on the basis of Article 6(1)(c) GDPR. Otherwise, processing may be based on our legitimate interest under Article 6(1)(f) GDPR. We state the legal basis that applies in each case in the following sections.

Recipients and transfers to third countries

We only pass personal data to external parties if this is necessary to perform the contract, if we are legally obliged to do so, if we have a legitimate interest in doing so or if you have given consent. With service providers that process data on our behalf, we conclude data processing agreements under Article 28 GDPR. Other members of Nexxus Pilot see your display name. They only see anything else if you share it with them under “Contacts”. If you have access to the knowledge pool, the other pool members also see your shared records, your lessons and your comments. New records are shared by default. Section 6 describes both.

Some of the services named in this policy are based in the USA. For transfers there, we rely on an adequacy decision of the European Commission (EU-US Data Privacy Framework) where the recipient is certified under it. Otherwise we rely on the European Commission’s standard contractual clauses under Article 46(2)(c) GDPR. The section on each service states which services this concerns.

Storage period

Unless a more specific storage period is stated in this policy, we store your data for as long as your account exists. After your account is deleted or after a justified request for deletion, we delete it unless statutory retention periods prevent this.

We back up our databases daily and in encrypted form. A backup is deleted after 30 days at the latest. Until then, data you have deleted may still be contained in it. We only access backups to restore operation after an outage.

TLS encryption

The website, the web app and the app transmit all data in encrypted form (TLS). You can recognise an encrypted connection in the browser by “https://” and the padlock symbol in the address bar.

No automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

5. Hosting and sign-in

Hetzner

The website, the web app, the database and all background services of Nexxus Pilot run on servers that we operate ourselves at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter: Hetzner). The servers are located in data centres in Germany. Your data from the app is likewise stored only on these servers. For push notifications and program updates, the app also connects to Expo (sections 8 and 9).

When the service is accessed, logs are created for technical reasons. Among other things, they contain your IP address, the address accessed, the browser type and the time. We use them only to detect faults and to fend off attacks. They are continuously overwritten as soon as the logs of a service reach a set size. They are not combined with other data.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and fault-free operation. A data processing agreement under Article 28 GDPR is in place with Hetzner.

Sign-in via Nexxus ID

You sign in via Nexxus ID, the shared sign-in system of the Nexxus products. It also runs on our own servers at Hetzner in Germany. Signing in is passwordless: you enter your email address and receive a link or code by email. Your email address, the times of your sign-ins and the identifier of your account are stored.

The legal basis is Article 6(1)(b) GDPR. Without signing in, we cannot provide your portfolio to you across devices.

6. Data in Nexxus Pilot

When you use Nexxus Pilot, we store the data you create yourself and the settings you choose:

• Portfolio: securities, purchase price, purchase date, quantity, sales and, for leveraged products, the product details
• Watchlist and pipeline with target price, amount and stop-loss
• Alerts: type, thresholds, starting point and triggered notifications
• Notes and tags that you add to a security
• Profile: name, plan, language, display currency and notification settings
• Identifiers of your devices and browsers for push notifications, as long as you allow them
• Which notices you have read and messages you send us via the app
• Mappings from a portfolio import, so that a repeated import is recognised

The legal basis is Article 6(1)(b) GDPR (performance of the user agreement). The data is stored on our servers at Hetzner in Germany. It is not passed on to third parties unless this policy states otherwise.

Contacts

Nexxus Pilot is open to invited members only. Under “Contacts”, every member sees the other members with their display name. Members without a display name appear as “Unknown”. No other member sees your email address.

You decide for each contact what else they can see. At first, nothing is shared. If you share your portfolio or your watchlist, the contact sees the securities in it with their current price and price performance. They also see whether a position is a leveraged product. In the watchlist, they also see when you added a security and at what price. With “Tags” on, they see your tags on these positions. With “Figures” on, they additionally see the quantity, purchase price and purchase date of your portfolio positions as well as the date you added them. With “News” on, they receive a notification with a timestamp when you add a security to your portfolio or watchlist and when you remove one from it. This only applies to the area you have shared with them.

“Contacts” never shows a contact your notes, alerts, pipeline or sales. The same applies to the rest of your profile and account data. What pool members see is described below under “Knowledge pool”. You can change or withdraw your sharing settings under “Contacts” at any time. Once you stop sharing something, the contact no longer sees it. The related notifications are deleted. If a member leaves Nexxus Pilot or deletes their account, all sharing settings they have granted or received are deleted, along with the related notifications.

The data stays on our servers at Hetzner in Germany. The only recipients are the other members, to the extent described above. The legal basis is Article 6(1)(b) GDPR, because contacts are a feature of Nexxus Pilot that you use yourself.

Knowledge pool

The knowledge pool is an area of Nexxus Pilot only for members who have been explicitly given access to it. Other members do not see it. In the pool, you record why you buy a security or decide against buying it. Each such decision is a record. For each record, we store:

• Decision: security, direction, type of entry (setup), time of the decision, your reasoning and the condition under which it would be wrong
• Plan: planned stop distance, holding period, date of the next quarterly results, the product with its ISIN and leverage (such as a turbo) as well as which of your trading rules you checked
• Origin: your own idea or a tip with its source, plus a link to a trading signal if there is one
• Flags: “retroactive”, “not triggered” (an order was never executed) and “withdrawn”
• Self-assessment: reason for exit, types of mistake and your lesson from the record
• Purchases and sales: date and time, quantity, price of the certificate, price of the underlying and the order number from your broker, finanzen.net ZERO
• Follow-ups: notes, stop changes and comments
• Lessons: title, statement, figures, status and links to records

Your personal tool transfers purchases and sales from your order history at ZERO, using your own Nexxus Pilot sign-in. You can correct or delete them. We store changes to records, purchases and sales with their old and new values. The title and statement of a lesson are fixed once it has been created. Only its figures and status are updated. No member can delete records, follow-ups or lessons themselves, not even you. This keeps the evaluation honest. You can only withdraw a record within the first 24 hours and only as long as there has been no purchase. The record then remains but no longer counts in the evaluation. “Retroactive” means that the decision was made before the record was created. Nexxus Pilot also sets this flag itself if a purchase took place more than two hours before the time of the decision or a sale took place before it at all.

Nexxus Pilot calculates the result of your purchases and sales in R, meaning multiples of the planned risk. It does this from the prices entered, each time the result is requested, and uses the latest closing price for any units still open. Once a day, Nexxus Pilot uses market prices to measure how the share has performed since the decision. This includes the largest interim gain and the largest interim loss since the purchase, as well as a note on share splits. The evaluation shows all pool members the results per person: number of cases, hits, average R and total R. It is based only on the records that the member in question is allowed to see.

New records are shared, which means all pool members can see them. You decide whether a record is shared when you create it. This cannot be changed afterwards. Only you can see a record that is not shared. For a shared record, the other pool members see the details listed above, including your self-assessment and the follow-ups. Only the amounts stay hidden: for your purchases and sales, they see the date and time, the price of the underlying, the portion (such as “half sold”) and the result in R. Only you see the quantity, price of the certificate and order number. We show portions and results to others rounded. For a turbo, the price of the certificate can be worked out from the price of the underlying and the public data of the certificate, but the quantity cannot. The same applies to the log of changes to your purchases and sales. Every pool member can comment on any record they can see, including their own. All pool members can see lessons. A lesson can link to records of other members. If you are removed from the pool or leave Nexxus Pilot, you no longer see the pool. Your shared records remain visible to the other pool members until you delete your account.

If you delete your Nexxus Pilot account, we delete everything you created in the knowledge pool. This includes comments from other members on your records. If another member’s lesson links to one of your records, the lesson remains. The link then leads nowhere. We delete individual records on request, together with their purchases, sales and follow-ups. They then no longer count in the evaluation. Administrator accounts cannot be deleted via “Delete account”. We delete them on request. Your right to erasure under Article 17 GDPR remains unaffected (section 3).

The data is stored on our servers at Hetzner in Germany. Nexxus Pilot only passes it on to the pool members, to the extent described above. Every pool member can analyse the pool with their own AI assistant. In that case, the records the member is allowed to read (without other members’ amounts) go to the provider of that assistant, currently Anthropic in the USA. These can include your shared records. This is the member’s personal assistant, not Nexxus Pilot. The legal basis is Article 6(1)(b) GDPR, because the knowledge pool is a feature of Nexxus Pilot that you use yourself.

Cookies and local storage

We only use cookies that are necessary for operation: one cookie that keeps you signed in and two cookies that store your chosen language and display currency for one year. In your browser’s local storage we keep display settings, such as the sorting of your lists, the chart period and the light or dark appearance. This information does not leave your device.

The legal bases are Section 25(2) no. 2 TDDDG and Article 6(1)(b) GDPR. The TDDDG provision applies because this storage is strictly necessary for the service you have requested. We do not use analytics, tracking or advertising cookies.

Contact

If you write to us by email or via the app’s messaging function, we store your message and your contact details in order to handle the request. The legal basis is Article 6(1)(b) GDPR where your request relates to the user agreement, otherwise Article 6(1)(f) GDPR. We delete the messages once the purpose no longer applies, at the latest together with your account.

7. Price and company data

We obtain stock prices, price histories, company data and news data from the service EOD Historical Data (EODHD). Exchange rates also come from EODHD. We obtain ad hoc announcements from ad-hoc-news.de. Details of leveraged products and security identifiers come from OpenFIGI, onvista and the respective issuers. All these requests are made by our servers. Only the identifiers of the securities are transmitted, such as the ISIN or ticker symbol, no information about you. Your device does not connect to these services.

8. Email and push notifications

Email delivery (Scaleway)

We send emails from Nexxus Pilot via the Scaleway service, for example sign-in links, the reminder before a trial ends, the reminder before an automatic renewal or notifications you have switched on. The provider is Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France (hereinafter: Scaleway). Your email address and the content of the respective message are transmitted. The legal basis is Article 6(1)(b) GDPR. A data processing agreement under Article 28 GDPR is in place with Scaleway.

Push notifications in the app (Expo)

If you allow push notifications in the app, we send you notices, for example when an alert fires. Delivery runs via Expo’s push service. The provider is 650 Industries, Inc., Palo Alto, California, USA (hereinafter: Expo). Expo forwards the message to Apple’s or Google’s push service, which delivers it to your device. The push token of your device and the text of the message are transmitted, for example the name and price of the security concerned and the type of alert. Your name and email address are not transmitted.

Push notifications in the browser

If you allow push notifications in the browser, delivery runs via the push service of your browser’s maker: Google, Mozilla or Apple, depending on the browser. The push token of your browser and the text of the message are transmitted.

The legal basis for push notifications is your consent on the device or in the browser (Article 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the settings. We then delete the push token. The transfer to Expo in the USA is based on standard contractual clauses under Article 46(2)(c) GDPR.

9. The app

You download the apps for iOS and Android from Apple’s App Store or from Google Play. When you download them, Apple or Google processes data such as your account identifier and the time. We have no influence on this. The privacy policy of the respective store applies.

The app loads program updates via Expo’s update service (650 Industries, Inc., USA). This transmits the IP address of your device, the installed version of the app and the operating system, but no information from your account. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to bring bug fixes to all devices quickly. The transfer to the USA is based on standard contractual clauses under Article 46(2)(c) GDPR.

10. Payment processing

Purchases on our website (Stripe and Link)

We use Stripe for paid plans that you take out on our website. The purchase is handled by Sold through Link, LLC, a Stripe group company based in the USA (hereinafter: Link). Link collects the payment and issues the invoice in its own name. It does so on our behalf. For the data involved in the purchase, Stripe or Link is a controller in its own right, not our processor. We and Stripe are independent controllers.

Stripe processes your name, email address, phone number, billing and shipping address, payment details, tax ID and order data. So that we can fulfil your order, Stripe passes some of this information on to us. This may include contact details, payment information, tax ID, billing and shipping address and order details. We do not receive your full payment details.

Outside the Americas, Stripe Technology Company, Limited in Ireland is the primary controller. Its supervisory authority is the Irish Data Protection Commission. Details are given in Link’s privacy policy (https://link.com/privacy).

Data that we transfer to Stripe goes to Stripe, LLC in the USA. Stripe itself may also transfer data there. The basis is Stripe’s Data Transfers Addendum. Depending on the case, it provides for the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses under Implementing Decision (EU) 2021/914.

The legal basis for our processing of this data is Article 6(1)(b) GDPR (performance of a contract) as well as Article 6(1)(c) GDPR where statutory retention obligations apply. We delete your data in Nexxus Pilot together with your account. This does not affect the purchase data held by Stripe and Link, including the data in our Stripe account. Stripe deletes this data if you request deletion from Link. Stripe then removes it from all purchases made through Link, including from our Stripe account. In doing so, Stripe cancels all your subscriptions sold through Link, including your Nexxus Pilot subscription.

Purchases in the app

Plans that you take out in the app are billed by Apple or Google. We receive a confirmation of the purchase from the respective store. It contains a purchase identifier, the booked plan, the term, the price with its currency and the country of the store in which you made the purchase. We do not receive payment details. Our servers verify this confirmation directly with the store so that your plan also applies in the browser. We use the price and the country for the email before an automatic renewal. The email states the price. The country tells us whether the law there requires such a reminder. The privacy policies of Apple or Google also apply.

11. Language model (Anthropic)

In some places Nexxus Pilot uses a language model. The provider is Anthropic PBC, 548 Market Street, San Francisco, California, USA (hereinafter: Anthropic). According to its own statements, Anthropic does not use the transmitted content to train its models.

Translations and news

We have Anthropic translate or briefly summarise headlines, company descriptions and news items that are not available in your language. The language model also helps when you search for a leveraged product by its identifier. Only these public texts and identifiers are transmitted, no information about you.

Portfolio check (Premium plan)

If you have switched on the Portfolio check, we summarise new events relating to the securities in your portfolio, such as notable price movements, dates or technical signals. We then have Anthropic assess how urgently they need a look. This produces a short briefing each morning. For this, the names of the securities concerned, their price change and the events are transmitted. Quantities, purchase prices, your name and your email address are not transmitted. You can switch off the Portfolio check in your profile at any time. It does not give any buy or sell recommendations.

Portfolio import

If you upload a file or a screenshot of your portfolio when importing, we transmit the rows it contains or the image to Anthropic so that the securities can be recognised and matched. This content may include your portfolio data, such as quantities and purchase prices. This only happens if you start the import yourself. You can also add positions by hand instead.

The legal basis is Article 6(1)(b) GDPR (performance of the user agreement). The transfer to the USA is based on standard contractual clauses under Article 46(2)(c) GDPR. Further information: https://www.anthropic.com/legal/privacy .

12. Changes to this policy

We adapt this privacy policy when our services or the legal situation change. The version published here applies. We inform registered users of significant changes in the app.