Privacy policy.

This notice applies to the Codebeamer Migration Hub at codebeamermigration.com. It does not govern a destination website after you follow an external link.

The Website has no account, upload function, or on-site contact form. You do not provide migration project data to use the guides. Technical connection data is required to deliver the requested pages; without it, the Website cannot be served. Analytics is optional, and declining it has no effect on access.

This may include the IP address, approximate location derived from it, request date and time, requested path, referring page, browser and device information, response status, session or device identifiers, and error or security diagnostics. The purposes are page delivery, encrypted transport, availability, abuse prevention, troubleshooting, and security.

Our legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are the secure, efficient, and reliable provision of this information service. Lovable acts as a processor for hosted customer data. Its current terms also provide that it may process certain service and operational log data under its own responsibility for security, analytics, billing, and product development.

Lovable uses Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) as its edge and hosting infrastructure provider; Cloudflare terminates TLS and processes the connection data listed above at the edge location closest to the visitor. Where processing involves a country without an EU adequacy decision, Lovable states that EU Standard Contractual Clauses are used; transfers to the United States may additionally rely on Cloudflare's and Lovable's participation in the EU-U.S. Data Privacy Framework where applicable. You can request information about the safeguards from us.

We store one first-party preference cookie under the name cookie-consent. It contains your choice (accepted or declined) and a consent-version number. It expires after 12 months and uses SameSite=Lax and, on HTTPS, the Secure attribute.

This cookie is required to store and apply your selection and to avoid asking on every page. Device access is based on § 25(2) no. 2 TDDDG. Associated personal-data processing, where applicable, is based on Art. 6(1)(c) GDPR for consent compliance and Art. 6(1)(f) GDPR for a usable preference mechanism.

If you accept, we load HubSpot tracking code for portal 8684517. It may process online identifiers and cookie IDs, IP address, page URL and path, referrer, visit time, session and navigation activity, browser, operating system, device type, and country or approximate location. NANGA uses these data to understand which guide content is used and to improve the Website.

Device storage and access are based on your consent under § 25(1) TDDDG; associated processing by NANGA is based on Art. 6(1)(a) GDPR. You may withdraw at any time through Cookie settings. Withdrawal applies to the future and does not affect processing that was lawful before withdrawal.

Recipient: HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA, together with the HubSpot affiliate and subprocessors applicable to NANGA's account. HubSpot's current terms state that the role for tracking-code data can depend on enabled account functions. For certain functions, including tracking-code intent-data sharing, HubSpot may process data as an independent controller for its own stated purposes. The source code on this Website embeds no HubSpot forms, chat widget, or advertising pixels.

HubSpot service data can be processed for the term of the HubSpot agreement unless deleted earlier under account settings or legal requirements. Transfers to the United States may rely on an applicable adequacy mechanism, including HubSpot's stated EU–U.S. Data Privacy Framework participation, and on the EU Standard Contractual Clauses incorporated into HubSpot's DPA.

The Website itself has no contact form. If you contact NANGA using the email address or telephone number shown here, we process the contact details, content, and communication metadata you provide in order to answer you. Art. 6(1)(b) GDPR applies where the request concerns a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR applies, based on our legitimate interest in responding to relevant enquiries.

Enquiry data is kept until the matter is completed and then deleted unless statutory retention duties or the establishment, exercise, or defence of legal claims require longer storage.

Links to NANGA's main website and other third-party websites establish a connection only when you select them. These links open with referrer information suppressed where the browser supports it. The destination provider's privacy notice applies after you leave this Website.

The "30-min Migration Strategy Call" call-to-action is a plain outbound link to HubSpot Meetings on meetings.hubspot.com, operated by HubSpot, Inc. No HubSpot booking widget, form, or script is embedded in this Website. Once you follow the link, HubSpot receives your IP address, referrer, and any HubSpot cookies set on its own domain, and acts as an independent controller for the booking flow. HubSpot's privacy policy applies from that point on.

We do not sell personal data. Depending on the processing described above, recipients may include:

• authorized NANGA personnel who need the information for their work;
• Lovable and its infrastructure subprocessors for hosting, delivery, and security;
• HubSpot group entities and subprocessors, but only for analytics after consent;
• communications and IT providers when you contact us; and
• courts, authorities, legal advisers, or auditors where disclosure is legally required or necessary for legal claims.

The hosting and analytics sections describe possible transfers outside the EEA and the relevant safeguards. Copies or further information about applicable safeguards can be requested from the controller; protected commercial information may be redacted.

NANGA does not use Website data for automated decisions that produce legal or similarly significant effects under Art. 22 GDPR, and does not use this Website for targeted advertising. Provider-side processing under a provider's own responsibility is described in that provider's privacy information.

If an exact period cannot be stated, the criterion is whether the data is still needed for the stated purpose, security, contractual documentation, statutory retention, or legal claims. Data is deleted or anonymized when none of those grounds remains.

Where the statutory conditions are met, you may request:

Send a request to info@nangasystems.com or to the data protection officer. We may request information needed to verify identity. GDPR requests are generally answered within one month and are normally free of charge.

You may lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or the alleged infringement. The authority responsible for NANGA's establishment is:

We use technical and organizational measures appropriate to the nature and risk of the processing, including encrypted HTTPS transport for the production Website, restricted administrative access, and provider security controls. No internet transmission can be guaranteed to be completely secure.

We update this notice when processing, providers, legal requirements, or account settings materially change. The consent record is versioned so that a material change to the analytics choice can trigger a new request rather than silently relying on an outdated selection.