Privacy Policy

Last updated: 3 August 2026

1. Controller

The controller responsible for the processing of personal data through this website is:

NUR Engineering GmbH
Am Buchenbusch 63
47229 Duisburg
Germany

Represented by: Dr.-Ing. Saad Jabir

No data protection officer has been appointed unless otherwise stated, because we are not currently legally required to appoint one.

2. Scope of this Privacy Notice

This Privacy Notice explains how we process personal data when you:

visit movetrics.com;
use an embedded form;
contact us by email, telephone or WhatsApp;
book an appointment through Cal.com;
use automatic website translation;
consent to optional website analytics.

Personal data means any information relating to an identified or identifiable natural person.

We process personal data only where a lawful basis exists. Depending on the circumstances, this may be:

your consent under Art. 6(1)(a) GDPR;
the performance of a contract or steps taken at your request before entering into a contract under Art. 6(1)(b) GDPR;
compliance with a legal obligation under Art. 6(1)(c) GDPR;
our legitimate interests under Art. 6(1)(f) GDPR.

Where information is stored on or accessed from your device, we additionally apply §25 TDDDG.

3. Website hosting and server log files

Our website is hosted using services supplied by OVHcloud. OVHcloud processes website and server data on our behalf under a data-processing agreement.

When you access the website, the hosting infrastructure may process:

your IP address;
the date and time of access;
the requested page or file;
the referrer URL;
browser type and version;
operating system;
host name;
HTTP status code;
the volume of data transferred.

The processing is necessary to deliver the website, maintain its stability, identify technical errors and protect it against attacks and misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and technically correct operation of the website.

Server log files are deleted or anonymised within 14 days unless a security incident requires longer retention. Data connected with a security incident may be retained until the incident has been investigated and any resulting legal claims have expired.

OVHcloud offers EU-based hosting and data-processing arrangements.

4. Encryption

This website uses TLS encryption. An encrypted connection can normally be identified by the “https” address and the browser’s security indicator.

Encryption protects data transmitted between your browser and our website. It cannot eliminate every security risk associated with electronic communications.

5. Cookies, local storage and consent management

Our website may use cookies or comparable technologies such as local storage. These technologies may store information on your device or access information already stored there.

Technologies that are strictly necessary to provide a service expressly requested by you may be used under §25(2) TDDDG. Associated personal-data processing is based on Art. 6(1)(c) or Art. 6(1)(f) GDPR, depending on its purpose.

All non-essential services are activated only after you provide consent under §25(1) TDDDG and Art. 6(1)(a) GDPR.

We use Compliance to obtain, manage and document your choices. In this context, we process your consent selection, the time of the selection, the applicable consent configuration and a technical identifier needed to document the decision.

This processing is necessary to meet our legal accountability obligations and to respect your choices. The legal bases are Art. 6(1)(c) and Art. 6(1)(f) GDPR and §25(2)(2) TDDDG.

Consent documentation is retained for up to three years. You can change or withdraw your decision at any time through the “Privacy settings” link in the footer. Withdrawal does not affect processing that occurred lawfully before withdrawal.

6. Independent Analytics

With your consent, we use the WordPress plugin Independent Analytics to understand general use of the website.

Depending on its configuration, the plugin may process:

pages viewed;
referrer information;
date and time;
browser and device information;
approximate geographical information;
your IP address and user-agent string temporarily in order to create a hashed visitor identifier.

The raw IP address is not stored in the analytics database. The identifier is created using a one-way hash and a rotating salt. The salt must be configured to rotate every 24 hours so that visitors are not recognised over an extended period.

Analytics data is stored in our own WordPress database on our hosting infrastructure. According to the provider, no analytics data is transmitted to Independent Analytics or other external analytics servers.

The purpose is to measure website reach, identify commonly used pages and improve website structure and content.

The legal bases are your consent under Art. 6(1)(a) GDPR and, insofar as device information is accessed, §25(1) TDDDG.

Analytics data is retained for no more than 14 months and subsequently deleted or aggregated. You may withdraw your consent at any time through the privacy settings.

7. Embedded forms supplied by Tally

We use forms supplied by Tally. These forms are embedded in pages on our website.

The Tally iframe is not loaded until you consent to the external service. Before consent, a placeholder is displayed instead.

When the form is loaded, Tally may receive technical connection data, including:

your IP address;
date and time;
browser and device data;
the referring and requested pages;
cookies or comparable identifiers.

The loading of the embedded form is based on your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG.

When you submit a form, we process the information you enter. Depending on the form, this may include:

name;
business contact information;
organisation and position;
country;
product interest;
project or application information;
your message;
any additional information you submit voluntarily.

Where your submission concerns a potential or existing contract, processing is based on Art. 6(1)(b) GDPR. For other business inquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to receive, organise and respond to inquiries and applications.

Tally processes submitted data on our behalf. We use Tally subject to a data-processing agreement. Tally’s processing agreement provides for subprocessors and appropriate safeguards for transfers outside the EEA, including European Commission Standard Contractual Clauses where required.

Raw form submissions are deleted from Tally within 90 days. Information transferred to our email, customer or business records is retained according to the purpose of the inquiry and the periods described below.

Do not provide special-category data under Art. 9 GDPR, such as medical or health information, unless a particular form expressly requests it and provides a separate privacy notice.

8. Appointment booking through Cal.com

Our website contains external links to appointment-booking pages operated by Cal.com.

No Cal.com booking page or script is embedded on this website. Data is transferred to Cal.com only after you actively open the external link.

When you use the Cal.com booking page, Cal.com may process:

your name;
email address;
time zone;
selected appointment;
answers to booking questions;
technical connection and usage data;
information needed to send confirmations and reminders.

We process booking information to arrange and conduct the requested appointment. The legal basis is Art. 6(1)(b) GDPR where the appointment relates to pre-contractual or contractual matters. In other cases, the legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in efficiently organising meetings.

Cal.com is a US provider and states that information may be processed in the United States. Cal.com provides a data-protection agreement and publishes information about its subprocessors and international processing.

Booking records are normally deleted 12 months after the appointment. They may be retained longer where they form part of a contractual relationship or are needed to establish, exercise or defend legal claims.

9. Contact through WhatsApp

We provide links and QR codes that open a WhatsApp conversation with a pre-formulated message.

The message is inserted into the WhatsApp text field but is not sent to us until you actively send it. WhatsApp confirms that pre-filled messages can be used in click-to-chat links.

When you open WhatsApp or send a message, WhatsApp may process your IP address, device information, telephone number, profile information and communications metadata. When you send us a message, we process your telephone number, profile name, message content and any attachments you provide.

The WhatsApp service is supplied by WhatsApp Ireland Limited and other companies within the Meta group. Processing may involve recipients outside the EEA.

The legal basis is Art. 6(1)(b) GDPR where your communication concerns a contract or pre-contractual request. Otherwise, the legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in offering a convenient communication channel.

Using WhatsApp is voluntary. You can contact us by email or telephone instead without suffering any disadvantage.

WhatsApp communications are normally deleted within 12 months after the matter has been concluded, unless they form part of contractual or legally relevant business records.

10. Contact by email, telephone and other communications

When you contact us, we process the information necessary to handle the communication. This may include:

your name;
email address or telephone number;
organisation and role;
date and time;
communication content;
attachments;
information concerning an inquiry, order or contract.

We use Google Workspace and one.com for email and related communication services. Depending on the address used, communications may be processed through either provider.

Google Workspace provides contractual data-processing terms that incorporate safeguards for European data-protection and international-transfer requirements.

One.com acts as a processor for customer email and hosting data under its data-processing agreement.

The legal basis is Art. 6(1)(b) GDPR where the communication concerns a contract or steps before entering into one. Otherwise, it is Art. 6(1)(f) GDPR, based on our legitimate interest in responding to business and support inquiries.

General inquiries are normally deleted 12 months after the final response. Communications relating to contracts, orders, invoices or legally relevant business matters are retained for the applicable statutory retention and limitation periods.

11. Automatic translation through GTranslate

Where activated, our website offers automatic translations through GTranslate and translation technology supplied by Google.

The translation service is loaded only after you consent. When activated, the providers may receive:

your IP address;
browser and device information;
the page requested;
the language selected;
website content submitted for translation;
date and time of use.

The legal bases are your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG.

GTranslate Inc. is based in the United States. Google services may also involve processing outside the EEA. Third-country processing may expose data to different legal systems and governmental-access rules.

You may use the original English website without activating the translation service. You can withdraw your consent through the privacy settings.

Do not enter confidential information, personal data or special-category data into content that is automatically translated.

Automated translations may contain errors. Privacy information and other legally relevant content should therefore also be provided in manually reviewed language versions.

12. Spam protection

The WordPress plugin Antispam Bee may be used where WordPress comment functions are enabled.

It is used to detect and prevent spam. Depending on its configuration, comment data, including IP addresses, may be examined for spam detection.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the website against spam and abuse.

Antispam Bee states that it does not transmit or independently store private user data, although WordPress itself may store comment information.

If comments are disabled throughout the website, this section should be removed.

13. SEO functionality

We use The SEO Framework to generate technical search-engine metadata and improve the machine-readable structure of the website.

In its standard configuration, the plugin does not independently track website visitors or create visitor profiles. No separate consent is therefore required for the basic plugin. Optional extensions that connect to analytics platforms, advertising services or remote monitoring systems must not be activated without a separate assessment and, where necessary, prior consent.

14. Recipients of personal data

Personal data is accessible only to persons and service providers who require it for the purposes described in this Privacy Notice.

Recipients may include:

hosting and infrastructure providers;
email and communication providers;
form and appointment-booking providers;
IT support and website administrators;
professional advisers;
authorities, courts or other public bodies where disclosure is legally required.

Processors are engaged under Art. 28 GDPR where applicable. We do not sell personal data.

15. International data transfers

Some providers may process personal data outside the European Union or European Economic Area, particularly in the United States.

Where no adequacy decision applies, transfers are based on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where required, supplementary technical and organisational measures.

Where a US recipient is validly certified under the EU-US Data Privacy Framework, transfers may also rely on the European Commission’s adequacy decision.

Despite these safeguards, third-country processing can entail residual risks, including access by foreign public authorities and limitations on effective legal remedies.

16. Storage periods

We retain personal data only for as long as necessary for the purpose for which it was collected.

The principal periods are:

server logs: normally 14 days;
Tally raw submissions: 90 days;
general inquiries: 12 months after completion;
Cal.com bookings: 12 months after the appointment;
WhatsApp communications: 12 months after completion;
Independent Analytics data: no more than 14 months;
consent documentation: up to three years;
contractual, accounting and tax records: for the applicable statutory periods.

Data may be retained longer where necessary to comply with legal obligations, investigate security incidents or establish, exercise or defend legal claims.

17. Your rights

Subject to the statutory requirements, you have the right to:

obtain access to your personal data under Art. 15 GDPR;
request rectification under Art. 16 GDPR;
request erasure under Art. 17 GDPR;
request restriction of processing under Art. 18 GDPR;
receive data portability under Art. 20 GDPR;
object to processing under Art. 21 GDPR;
withdraw consent under Art. 7(3) GDPR;
lodge a complaint with a data-protection supervisory authority under Art. 77 GDPR.

To exercise your rights, contact us using the details in Section 1. We may need to verify your identity before fulfilling a request.

Withdrawing consent does not affect the lawfulness of processing undertaken before withdrawal.

18. Right to object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation.

We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing, you may object at any time without stating reasons. Processing for direct marketing will then cease.

19. Right to complain

You may lodge a complaint with any competent data-protection supervisory authority.

The supervisory authority responsible for our establishment is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

Postal address: Postfach 20 04 44, 40102 Düsseldorf
Email: poststelle@ldi.nrw.de
Telephone: +49 211 38424-0

20. Obligation to provide data

You are not legally obliged to provide personal data merely to visit the general website.

Certain information is necessary when you ask us to respond, arrange an appointment, prepare an offer or perform a contract. Without that information, we may be unable to process your request or provide the requested service.

21. Automated decision-making

We do not currently use personal data collected through this website for decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Art. 22 GDPR.

22. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access.

No internet-based system can provide absolute security.

23. Changes to this Privacy Notice

We may amend this Privacy Notice where our processing activities, services or legal obligations change.

The version published on this page is the current version. Material changes affecting consent-based processing will be reflected in the consent-management configuration and may require renewed consent.