Privacy notice

1. Controller

Noah Okorie, trading as Northstar Systems
Carl-Mannich-Straße 26, 65760 Eschborn, Germany
info@northstar-systems.de

2. Website delivery and security

The website is delivered using Amazon Web Services (AWS), including Amazon S3 and Amazon CloudFront. When the site is accessed, technical data such as the IP address, time, requested resource, browser or device information, and security events may be processed to deliver the site and protect it against misuse. Edge-security logs for blocked requests may contain the source IP, request path, and user-agent. Application logs use a salted pseudonymous identifier instead of the source IP. These security logs are retained for 14 days.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of the website.

3. Enquiries and assessments

The contact and assessment forms collect your name, work email, company, service of interest, message, language, consent timestamp, and a generated lead reference. We use this information only to evaluate and respond to your request and, where relevant, to take steps before entering into a contract.

The legal bases are Article 6(1)(b) GDPR for pre-contractual requests, Article 6(1)(f) GDPR for business communications, and Article 6(1)(a) GDPR where you provide consent. You may withdraw consent at any time; this does not affect processing that took place before withdrawal.

Form records are encrypted at rest in Amazon DynamoDB and configured for automatic expiry after 180 days. A copy is sent through Amazon Simple Email Service to our Google Workspace mailbox. Correspondence is deleted when it is no longer required, unless it must be retained for contractual, evidentiary, tax, or commercial-law obligations.

4. Speculative applications

If you submit an application, we process your name, email, location, professional links, message, language, and consent timestamp to review your profile and contact you. The legal bases are Article 6(1)(b) GDPR and section 26 of the German Federal Data Protection Act where applicable. Application data is normally deleted within six months after our decision unless you agree to longer retention or legal obligations require it.

5. Service providers and international processing

AWS processes hosting, security, database, and form-delivery data on our behalf. Google Workspace processes business email. Depending on service delivery and support, these providers may process data outside the European Economic Area. Where required, transfers are protected by an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism.

6. Language preference

When you choose English or French, the site stores the strictly functional cookie northstar-language for one year so it can remember that choice. It is not used for advertising or tracking. This storage is necessary to provide the language setting you request under section 25(2) TDDDG.

7. AI-guided readiness assessment

If you choose to start the guided readiness assessment, your answers and the preceding assessment conversation are sent to OpenAI to produce relevant questions and a preliminary summary. We also send a pseudonymous safety identifier used to protect the service against misuse. Do not enter credentials, confidential configurations, or sensitive personal information.

Processing starts only after you actively accept the notice shown before the assessment. The legal basis is Article 6(1)(a) GDPR. You can stop at any time. Assessment conversations are encrypted in Amazon DynamoDB and configured to expire after 24 hours. OpenAI API requests are sent with model-response storage disabled. OpenAI may nevertheless retain limited abuse-monitoring data under its applicable API data policy. The result is informational and does not involve a decision producing legal or similarly significant effects.

Authorized Northstar personnel may review a conversation during this retention period for security, support, or a follow-up explicitly requested by the visitor. When a visitor generates the preliminary summary, an anonymous copy of the conversation and summary is sent to our business mailbox so we can understand assessment demand and service needs. Contact details are collected through a separate form and are not required to use the AI conversation.

We do not currently use advertising trackers or audience analytics.

8. Your rights

Subject to the applicable conditions, you may request access, correction, deletion, restriction, or portability of your personal data and object to processing based on legitimate interests. Contact us at the address above. You may also complain to a data-protection authority. The authority responsible for our location is the Hessian Commissioner for Data Protection and Freedom of Information, Wilhelmstraße 7, 65185 Wiesbaden, Germany.

9. Changes

We update this notice when the website, our providers, or the applicable processing changes. The current version is always available from the website footer. See also our imprint.