Privacy Policy

Last updated: October 2026

1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to personally identify you. Detailed information on the subject of data protection can be found in our privacy policy set out below this text.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the "Notice concerning the responsible party" section of this privacy policy as well as in the legal notice (Impressum).

For certain processing activities, in particular the inquiry form for AVGS start-up coaching, joint responsibility exists together with another company. Further details can be found in Section 4.

How do we collect your data?

Your data is collected, on the one hand, from information you provide to us. This may, for example, be data you enter in a contact or inquiry form.

Other data is collected automatically, or after you have given your consent, by our IT systems when you visit the website. This is primarily technical data such as the internet browser, operating system, or the time the page was accessed.

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors. Other data may be used to process your inquiries or, provided you have given your consent, to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction, deletion, or restriction of the processing of this data, as well as a right to data portability and a right to object. You can revoke a consent you have given at any time. For this purpose, as well as for further questions on the subject of data protection, you can contact us at any time using the address given in the legal notice. You also have the right to lodge a complaint with the competent supervisory authority.

Analytics Tools and Third-Party Tools

When you visit this website, your surfing behavior may be statistically evaluated. This is done primarily using cookies and so-called analytics programs. This evaluation is only carried out if you have given your consent via our consent banner. You can revoke or adjust your consent at any time. Detailed information can be found in Sections 5 and 7 of this privacy policy.

2. General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

When you use this website, various pieces of personal data are collected. This privacy policy explains what data we collect, what we use it for, and on what legal basis this is done.

We would like to point out that data transmission over the internet, for example when communicating by email, can have security gaps. Complete protection of data against access by third parties is not possible.

Notice Concerning the Responsible Party

The party responsible for data processing on this website is:

M&M Consultants UG (haftungsbeschränkt)
Managing Director Georg Binienda-Meuser
Domherrnstr. 2
55268 Nieder-Olm

Email: info@nxtmilestone.com

The responsible party is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Storage Period

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing it. Statutory retention periods, in particular under commercial and tax law, remain unaffected.

Recipients of Your Data

We only pass personal data on to the service providers named in this policy that work on our behalf (HubSpot, Google, Cloudflare, Cognito Forms and JOIN) and, for the inquiry form for AVGS start-up coaching, to STARTUP PROFI as joint controller. Beyond that, we only disclose data where we are legally obliged to do so.

No Automated Decision-Making

No exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You can revoke consent you have already given at any time. An informal email to us is sufficient for this purpose. The lawfulness of any data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to Object to the Collection of Data in Special Cases (Art. 21 GDPR)

If data processing is carried out on the basis of Art. 6(1)(e) or (f) GDPR, you have the right at any time, for reasons arising from your particular situation, to object to the processing of your personal data. The relevant legal basis on which processing is based can be found in this privacy policy. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing. Following an objection, your data will no longer be used for direct marketing purposes.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work, or the place of the alleged violation. We are subject to the supervision of the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate). A list of supervisory authorities and their contact details can be found at:https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_node.html

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

Right to Information, Rectification, Erasure, and Restriction of Processing

Within the framework of the applicable statutory provisions, you have the right at any time to obtain free-of-charge information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, a right to rectification or erasure of this data.

You also have the right to demand that the processing of your personal data be restricted, in particular if you dispute the accuracy of the data, if the processing was unlawful, if you need the data for the assertion, exercise, or defense of legal claims, or if you have lodged an objection under Art. 21(1) GDPR. In the case of restriction, the data, apart from being stored, may only be processed with your consent, for the assertion, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

For these matters, as well as for further questions regarding personal data, you can contact us at any time using the address given in the legal notice.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address bar of your browser changes from "http://" to "https://" and by the padlock icon in your browser bar. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Data Transfer to Third Countries

We partly use services provided by providers based in third countries, in particular the USA. If these services are active, your personal data may be transferred to and processed in these third countries. We point out that a level of data protection comparable to that in the EU cannot be guaranteed in these countries. The transfer takes place, where applicable, on the basis of an adequacy decision of the European Commission, on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR, or on the basis of your consent pursuant to Art. 49(1)(a) GDPR. Details can be found in the descriptions of the individual services.

Objection to Promotional Emails

We hereby object to the use of contact data published within the context of legal notice (Impressum) obligations for the purpose of sending unsolicited advertising and informational material. The operators of these pages expressly reserve the right to take legal action in the event of the unsolicited sending of promotional information, for example through spam emails.

3. Data Collection on This Website

Cookies

These websites partly use so-called cookies. Cookies are small text files that are stored on your device and saved by your browser. They do not cause any damage to your device and do not contain any viruses. Cookies serve to make our offering more user-friendly, effective, and secure.

Most of the cookies we use are so-called "session cookies." They are automatically deleted after your visit ends. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser on your next visit.

Cookies that are required to carry out the electronic communication process or to provide certain functions you have requested are stored on the basis of Art. 6(1)(f) GDPR in conjunction with Section 25(2) TDDDG (German Telecommunications and Digital Services Data Protection Act). The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimized provision of its services.

All other cookies, in particular those used to analyze your surfing behavior or for marketing purposes, are only set with your consent. In this respect, the legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can revoke or adjust your consent at any time via the cookie settings on this website.

You can also set your browser so that you are informed about the setting of cookies, allow cookies only on a case-by-case basis, exclude the acceptance of cookies for certain cases or generally, and activate automatic deletion of cookies when the browser is closed. If cookies are deactivated, the functionality of this website may be limited.

Consent Management (Cookie Banner)

To obtain and manage your consent, we use our own cookie banner, which works without external services. As long as you have not agreed, neither Google Analytics, nor HubSpot tracking, nor Google Tag Manager is loaded, and no connection to their servers is made.

We store your decision in your browser’s local storage (entry “nxt-consent”). What is stored is your selection, the time of the decision and the version of the banner, but no IP address and no identifier that identifies you. We ask again after six months or when the processing changes materially. The legal basis is Art. 6(1)(c) and (f) GDPR, because we must obtain consent and respect your decision. Storing it is technically necessary for this purpose (Section 25(2) TDDDG) and needs no separate consent.

If you consent to the “Statistics” category, we load Google Tag Manager (Google Ireland Limited), through which Google Analytics and HubSpot tracking are integrated. The following cookies may be set:

You can change or withdraw your consent at any time with effect for the future:Open cookie settings

When you withdraw consent, we delete the cookies listed above and reload the page.

Hosting and Cloudflare

This website is delivered through Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the data that arises technically with every page request, in particular the IP address, and creates the logs described under “Server Log Files”. We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR. Where data is transferred to the USA, this is based on the EU Commission’s standard contractual clauses and, where Cloudflare is certified, on the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and fast delivery of the website.

We also use Cloudflare Web Analytics to measure the number of page views and visitors as well as referral sources, countries, browsers and load times in aggregated form. According to the provider, Cloudflare Web Analytics sets no cookies and stores no information on your device, and visitors are not recognized across websites. The measurement therefore takes place without consent, on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to capture the reach of our website completely, independent of consent decisions, and to detect errors and load times. You can object to this processing at any time under Art. 21 GDPR, for example by email to info@nxtmilestone.com. Further information is available at https://www.cloudflare.com/privacypolicy/.

Server Log Files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website. For this purpose, the server log files must be collected.

General Contact Form

The following notes apply to the general contact form on this website. The separate inquiry form for AVGS start-up coaching is covered by the special privacy notices in Section 4.

If you send us inquiries via the contact form, your details from the form, including the contact details you provide, are stored by us to process the inquiry and in case of follow-up questions. The form is provided via HubSpot (see Section 5). We do not pass this data on without your consent, except to the service providers named in this policy that work for us.

The legal basis is Art. 6(1)(b) GDPR where your inquiry is aimed at concluding or performing a contract or at pre-contractual measures. In all other cases, processing is based on our legitimate interest in handling inquiries addressed to us effectively (Art. 6(1)(f) GDPR). You can object to this processing under Art. 21 GDPR.

We delete your inquiry once it has been finally handled and no statutory retention obligations apply, at the latest two years after the last contact. Mandatory statutory provisions, in particular retention periods, remain unaffected.

Inquiry by Email or Telephone

If you contact us by email or telephone, your inquiry, including all resulting personal data, will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.

The processing of this data is based on Art. 6(1)(b) GDPR, provided your inquiry is related to the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where such consent has been obtained.

Job Applications

If you apply to us, we process your application documents and the details they contain exclusively for the application process. You can apply by email to hr@nxtmilestone.com or through our job portal at JOIN (join.com). We link to join.com but do not embed the portal in this website; only when you open join.com is data, in particular your IP address, transmitted to JOIN. Applications submitted through JOIN are processed by JOIN on our behalf (Art. 28 GDPR).

The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG. We delete application documents six months after the end of the process, unless you have consented to longer storage (Art. 6(1)(a) GDPR), for example for inclusion in our applicant pool.

4. Inquiry Form for AVGS Start-Up Coaching

For inquiries regarding AVGS start-up coaching, we provide a separate inquiry form together with STARTUP PROFI (MCF AG).

When the form is submitted, M&M Consultants UG (haftungsbeschränkt) and STARTUP PROFI each receive a complete copy of the information entered. The data is processed to handle and assign the inquiry and to prepare for the AVGS start-up coaching.

M&M Consultants UG (haftungsbeschränkt) and STARTUP PROFI are joint controllers within the meaning of Art. 26 GDPR for the collection, transmission, and assignment of the inquiry. The companies have set out their respective data protection duties and responsibilities in a corresponding agreement.

STARTUP PROFI processes the information in particular to review the inquiry, to make contact, and to initiate and organizationally and administratively carry out the AVGS start-up coaching. In this respect, processing is based on Art. 6(1)(b) GDPR.

M&M Consultants UG (haftungsbeschränkt) processes the information to manage and assign the inquiry as well as to prepare and, where applicable, carry out the coaching. In this respect, processing is based on Art. 6(1)(f) GDPR.

The essential information on the joint processing and the allocation of responsibilities is also provided directly at the respective inquiry form. Data protection rights can be asserted against both companies.

The data remains with us until the purpose of the processing no longer applies, you ask us to delete it, or you effectively object to further processing. Mandatory statutory retention periods remain unaffected.

Further information on data processing by STARTUP PROFI can be found athttps://startup-profi.de/datenschutz.

Technically, the questionnaire for redeeming the voucher is provided by Cognito Forms (USA). It is only loaded when you click “Load questionnaire”; only then is your IP address transmitted to Cognito Forms. Cognito Forms processes the details on our behalf (Art. 28 GDPR). Where data is transferred to the USA, this is based on the EU Commission’s standard contractual clauses and, where Cognito Forms is certified, on the EU-US Data Privacy Framework.

5. HubSpot

Use of HubSpot

We use the HubSpot platform on this website. The provider is HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland, with the possible involvement of HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

HubSpot is an integrated software solution that we use for various areas of our online presence, in particular for:

• providing and evaluating our contact and inquiry forms
• managing contact data in our customer relationship management (CRM) system
• booking appointments via HubSpot Meetings
• analyzing the reach and usage of our website

To the extent HubSpot processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR. HubSpot processes the data exclusively on our instructions.

The applicable legal basis depends on the specific purpose of use and is described in the subsections below.

To the extent personal data is transferred to the USA, this is done on the basis of the European Commission's standard contractual clauses and, where the provider is certified there, on the basis of the EU-US Data Privacy Framework. Further information can be found in HubSpot's privacy policy at https://legal.hubspot.com/privacy-policy

Forms and CRM

When you fill out one of our forms, the details you enter are processed via HubSpot and stored in our CRM so that we can handle your inquiry and document further contact. This includes the form fields you completed and technical metadata such as the time of submission, IP address and the page from which the form was sent. The form is only loaded when you open the contact window; before that, no connection to HubSpot is made.

The legal basis is Art. 6(1)(b) GDPR where the inquiry is aimed at concluding or performing a contract or at pre-contractual measures, and otherwise our legitimate interest in handling inquiries efficiently under Art. 6(1)(f) GDPR. For the inquiry form for AVGS start-up coaching, the special notices in Section 4 also apply.

We delete the data in the CRM when the purpose ceases to apply, at the latest two years after the last contact. If a contractual relationship exists, the statutory retention periods apply.

Appointment Booking (HubSpot Meetings)

For appointment bookings we link to HubSpot Meetings (meetings.hubspot.com). The page is only loaded from HubSpot, and your IP address transmitted to HubSpot, once you open such a link. If you book an appointment, HubSpot processes your name, your email address, the chosen time and the details you provide when booking, and stores them in our CRM.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request) or our legitimate interest in efficient appointment organization under Art. 6(1)(f) GDPR. The storage period corresponds to the one described under “Forms and CRM”.

Reach Measurement by HubSpot

Provided you have given your consent, HubSpot uses cookies and comparable recognition technologies to evaluate your behavior on this website, for example pages visited, time spent, referral source, and interactions with our content. This information may be linked to your contact record in our CRM, provided you have submitted your data to us via a form or when booking an appointment.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can revoke your consent at any time via the cookie settings on this website.

6. Social Media

LinkedIn

On this website we link to our LinkedIn company profile and to LinkedIn profiles of team members. No LinkedIn plug-ins or scripts are embedded. Only when you click one of these links do you leave our website, and LinkedIn receives data such as your IP address. LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, is responsible for this processing.

Further information can be found in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy

7. Analytics Tools and Advertising

Google Analytics

This website uses functions of the web analytics service Google Analytics. For users in the EU and EEA, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For data transfers to the USA, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is jointly responsible.

Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent, operating systems used, and the origin of the user. This data may be combined by Google into a profile that is assigned to the respective user or their device. Cookies and comparable recognition technologies may be used for this recognition.

This service is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You grant consent via our consent banner and can revoke it at any time via the cookie settings on this website.

IP Addresses

According to Google, Google Analytics 4 does not log or store visitors’ IP addresses. For technical reasons, Google nevertheless receives the IP address when the measurement data is transmitted.

Browser Plug-In

You can additionally prevent the collection and processing of your data by Google by downloading and installing the browser plug-in available at the following link:https://tools.google.com/dlpage/gaoptout?hl=de

Data Processing Agreement

We have entered into a data processing agreement with Google and implement the requirements of the German data protection authorities regarding the use of Google Analytics.

Data Transfer to the USA and Storage Period

The transfer of data to the USA is based on the European Commission's standard contractual clauses and, where the provider is certified there, on the EU-US Data Privacy Framework. Details can be found at https://business.safety.google/adsprocessorterms/and in Google's privacy policy athttps://policies.google.com/privacy

Data stored by Google that is linked to individual users or devices is automatically deleted after 2 months. Aggregated evaluations remain unaffected by this.