Legal
Cookie Policy
Last updated: 03 June 2026
This Cookie Policy explains which cookies and comparable technologies (e.g. local storage) we use. It supplements our Privacy Policy. The legal basis for non-essential technologies is your consent (Sec. 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR); for strictly necessary technologies, Sec. 25 (2) TDDDG.
1. What are cookies?
Cookies are small pieces of text stored in your browser. Comparable technologies (local storage, session storage) serve similar purposes. They can be session-related (deleted when the browser closes) or persistent.
2. Categories
Necessary (no consent required)
These technologies are essential for operations, e.g. for login/session, security, shopping cart, language settings and storing your cookie choice. Without them key parts of the services do not work.
Statistics / reach measurement (only with consent)
For anonymised usage analysis we use Google Analytics 4 with active Consent Mode v2 (default: no analytics storage) and IP anonymisation – exclusively after your consent.
Marketing / external content (only with consent)
Where used, these serve the integration of external content (e.g. embedded maps, advertising networks). No marketing cookies are currently active on a permanent basis; map embeds use a two-click solution.
3. Concrete cookie and storage inventory
The following overview lists the storage mechanisms actually in use. It is maintained whenever the inventory changes.
3.1 Necessary (TDDDG § 25 (2))
| Name / Key | Type | Provider | Purpose | Retention |
|---|---|---|---|---|
nbw-consent-v1 | local storage | Nobody Workz | Stores your cookie choice (necessary/statistics/marketing) | persistent until you withdraw or clear browser data |
nbw-theme | local storage | Nobody Workz | Stores your light/dark/system theme preference | persistent until you change it or clear browser data |
NEXT_LOCALE / locale cookie | cookie / local storage | Nobody Workz | Stores the selected language (de/en) | up to 12 months |
| Login/session token | httpOnly cookie | Nobody Workz | Authenticated session in the customer portal/admin | session, up to 7 days (refresh-token rotation) |
| 2FA and CSRF protection token | httpOnly cookie | Nobody Workz | Protection against cross-site attacks and replay | session |
__cf_bm | cookie | Cloudflare, Inc. (bot management) | Detection of automated access (bot protection) | up to 30 minutes per session |
cf_clearance | cookie | Cloudflare, Inc. | Successful bot/security check (Turnstile/challenge) | up to 30 days |
3.2 Statistics / reach measurement (TDDDG § 25 (1), only with consent)
| Name / Key | Type | Provider | Purpose | Retention |
|---|---|---|---|---|
_ga | cookie | Google Ireland Ltd. (Google Analytics 4, IP anonymisation, Consent Mode v2) | Reach measurement, device differentiation | up to 24 months |
_ga_G-WRXSWWYL1S | cookie | Google Ireland Ltd. | Session state for the respective GA4 property | up to 24 months |
3.3 Optional technologies (each with its own consent)
| Name / Key | Type | Provider | Purpose | Retention |
|---|---|---|---|---|
| Web push subscription | browser storage / service worker | Nobody Workz (VAPID key) | Push notifications, only after explicit browser consent | until withdrawal or automatic browser invalidation |
| Embedded map (e.g. OpenStreetMap, Google Maps, Apple Maps) | cookie/local after activation | respective map provider | Display of interactive maps only after two-click activation on the contact page | see provider |
4. Managing consent
On your first visit we ask for your consent via a cookie banner. You can enable or reject non-essential categories and change or withdraw your choice at any time via the cookie settings (footer link "Cookie settings") with effect for the future. Withdrawal is as easy as giving consent (Sec. 25 (3) TDDDG).
By default all non-essential technologies are disabled (opt-in). Before you grant your consent, in particular no Google Analytics cookies are loaded; this is additionally enforced technically via Google Consent Mode v2.
5. Retention
Necessary cookies are stored for the duration required (see table). Consent-based cookies are stored according to the respective provider''s information and at most until consent is withdrawn.
6. Browser settings
You can also manage or delete cookies via your browser settings. Blocking certain cookies may impair the functionality of the services.