Data Protection Information
Dear customer, interested party, contractual partner,
We are pleased to welcome you to our website and thank you for your interest in our company. We handle your data with the utmost care. The following information provides a concise and straightforward overview of what happens to your data when you visit our website. Your data is processed in accordance with applicable legal regulations, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Controller
The controller responsible for data processing within the meaning of the GDPR and other national data protection laws of EU member states is:
Noyes Robotics GmbH
Leopoldstraße 37a
80802 München
Germany
E-Mail: info@noyes-tech.com
Data Protection Contact
We have appointed an external data protection officer. For data protection enquiries, please contact:
Validity and Changes to this Information
This data protection information is valid and dated May 2026.
Due to the further development of our website or the implementation of new technologies, it may become necessary to amend this information. We reserve the right to make such changes at any time.
Data Protection Rights and Right to Object
Your rights to access, rectification, restriction, erasure, data portability and complaint
Every data subject has the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to object pursuant to Art. 21 GDPR and the right to data portability pursuant to Art. 20 GDPR.
With regard to the right of access and the right to erasure, the restrictions pursuant to §§ 34 and 35 BDSG apply.
Any consent to the processing of personal data may be withdrawn from us at any time. This also applies to the withdrawal of declarations of consent given before 25 May 2018. Please note that the withdrawal only takes effect for the future.
You also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG). As Noyes Robotics GmbH is headquartered in Munich, the competent authority is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
Tel.: +49 981 180093-0
E-Mail: poststelle@lda.bayern.de
Web: https://www.lda.bayern.de
Right to Object pursuant to Art. 21 GDPR
Individual right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 para. 1 lit. f GDPR (balancing of interests); this also applies to profiling based on this provision within the meaning of Art. 4 no. 4 GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
The objection can be made informally with the subject line "Objection", stating your name and address, to info@noyes-tech.com.
General Information
Routine deletion of data
We generally store your data only for the period required to achieve the storage purpose or as required by law. In Germany, a retention obligation of 6 years applies pursuant to § 257 para. 1 HGB and 10 years for tax-relevant documents pursuant to § 147 paras. 1 and 3 AO. Once the storage purpose ceases to apply or a statutory period expires, your data will be routinely deleted.
Data security
We use technical and organisational security measures to protect your personal data from misuse, loss, destruction or access by unauthorised persons. The website is transmitted exclusively in encrypted form via HTTPS (TLS). Security measures are updated continuously in line with the current state of the art.
Order processing by external service providers
Our website uses tools from third-party providers within the scope of order processing. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been properly concluded with all processors used, ensuring an adequate level of data protection.
Data transfers to third countries
When accessing our website, the integration of individual services may result in personal data being transferred to servers in third countries outside the European Union. Details, including the respective legal bases, can be found in the sections on individual third-party providers below.
Scope (external links)
This data protection information applies exclusively to visits to our own website. Some pages link to external third-party websites that are subject to the liability of their respective operators. Upon becoming aware of any legal infringements, we will remove such links immediately.
Cookies and Local Storage
Cookies are pieces of information transmitted from our web server or third-party web servers to users' web browsers, where they are stored for later retrieval. In addition to traditional cookies, we also use the browser's local storage (localStorage) for technically necessary purposes.
Technically necessary cookies and storage entries are stored on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR and § 25 para. 2 TTDSG. The use of technically non-essential cookies requires your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG.
You can withdraw or adjust your consents at any time via the "Cookie Settings" link in the footer of this website.
Consent management (own solution)
Purpose: Collecting and documenting cookie consents of website visitors in a data protection compliant manner.
Type of data processing: On your first visit to the website, you will be asked via a banner to indicate your consent preferences. These are stored exclusively locally in your browser's localStorage under the key noyes_consent_v1. The record contains your consent decisions (necessary, analytics, marketing) and a timestamp. No personal data is collected and no data is transmitted to third parties.
Legal basis: Art. 6 para. 1 lit. c GDPR (obligation to demonstrate consent pursuant to Art. 7 para. 1 GDPR) and § 25 para. 2 no. 2 TTDSG.
Retention period: Consent data remains in localStorage until you actively change it via "Cookie Settings" or delete your browser data.
Hosting
Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (service: Cloudflare Pages).
Purpose: Reliable availability and display of our website.
Type of data processing: When our website is accessed, Cloudflare automatically records technical access data in server log files. This includes: IP address, date and time, browser type, operating system, referring URL, page accessed and data transferred. This data is used exclusively to ensure technical operation and to detect attacks.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in reliable and secure provision of the website).
Transfer to third countries: Cloudflare is a US company certified under the EU-US Data Privacy Framework. A DPA has been concluded with Cloudflare.
Privacy policy of the provider: https://www.cloudflare.com/privacypolicy/
Data Processing on the Website
Contact requests
Purpose: Processing of enquiries.
Type of data processing: Enquiries by email or via our contact form — including all personal data arising therefrom (e.g. name, email address, company, message) — are stored and processed for the purpose of handling them. Data is not passed on without your consent.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to enquiries). Where your enquiry serves to initiate a contract, Art. 6 para. 1 lit. b GDPR.
Retention period: Your data will be deleted at the latest 6 months after the enquiry has been fully processed. Where a contractual relationship arises, statutory retention periods apply (6 and 10 years respectively).
Newsletter
Purpose: Sending a newsletter for marketing purposes.
Type of data processing: If you subscribe to our newsletter, your data will be used exclusively to send you the subscribed newsletter by email. Only a valid email address is required. All other information is voluntary.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent), obtained during newsletter sign-up.
Withdrawal: Consent can be withdrawn at any time. Each newsletter email contains an unsubscribe link.
Job applications via the website
Purpose: Processing of applications.
Type of data processing: Applicants may apply to us by email. We will inform you separately during the application process in accordance with Arts. 13, 14 and 21 GDPR about the details of the processing of your application data.
Legal basis: Art. 88 GDPR in conjunction with § 26 BDSG (decision on the establishment of an employment relationship).
Retention period: Application documents will be deleted at the latest six months after the conclusion of the application process, unless longer retention is legally required.
Third-Party Tools
HubSpot CRM
Provider: HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland (subsidiary of HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA).
Purpose: Efficient customer communication, customer management and newsletter distribution.
Type of data processing: When you contact us via our website form, your data (name, email address, company, message) is transmitted to HubSpot. We use the EU region of HubSpot (eu1), so your data is stored on servers within the EU. With your consent, we may also use HubSpot to manage marketing activities (e.g. newsletters).
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient customer management) for contact processing. For newsletters and marketing cookies: Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG (consent, withdrawable at any time).
Order processing: A DPA pursuant to Art. 28 GDPR has been concluded with HubSpot: https://legal.hubspot.com/dpa
Transfer to third countries: As HubSpot is a US company, data may in exceptional cases be transferred to the USA. Standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR are in place.
Privacy policy of the provider: https://legal.hubspot.com/privacy-policy
Social Media Presence
Purpose: Ensuring the broadest possible online presence.
We operate profiles on various social media platforms. Visiting our profiles triggers numerous data protection-relevant processing operations. Social networks can analyse user behaviour extensively, even when you are not logged in (e.g. via cookies or IP addresses).
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a comprehensive online presence).
Please note: The social media links on our website are pure references (no embedded content). Data is only transferred to the platforms when you click the respective link and visit the external platform.
Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Transfer to third countries: When visiting our LinkedIn profile, data is transferred to LinkedIn servers in the USA. The transfer is based on standard contractual clauses: https://www.linkedin.com/legal/l/eu-sccs
Privacy policy: https://www.linkedin.com/legal/privacy-policy
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Transfer to third countries: When visiting our Instagram profile, data may be transferred to Meta servers in the USA. The transfer is based on EU Commission standard contractual clauses: https://www.facebook.com/legal/EU_data_transfer_addendum
Privacy policy: https://help.instagram.com/519522125107875
YouTube
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Note: YouTube videos are not embedded on our website. The link refers to our external YouTube profile. Data is only transferred to Google/YouTube when the external platform is visited.
Privacy policy: https://policies.google.com/privacy