
|
Area
|
Purposes
|
Legal basis
|
Retention period
|
Details
|
|---|---|---|---|---|
|
Website operation
|
Provision, security, log files, cookie consent, spam protection
|
Article 6(1)(f) of the GDPR, Section 25(2)(2) of the TDDDG; anti-spam measures: Article 6(1)(a) of the GDPR, Section 25(1) of the TDDDG
|
Log files: 7 days; proof of consent: 1 year
|
Section 13
|
|
Communication and Support
|
Contact form, email, telephone, support tickets
|
Article 6(1)(b) and (f) of the GDPR
|
Until the enquiry is closed: 12 months; where there is a retention obligation: 6 or 10 years
|
Section 14
|
|
Marketing, newsletters and web analytics
|
Newsletters, usage analysis, advertising and performance measurement
|
Article 6(1)(a) of the GDPR, Section 25(1) of the TDDDG
|
Newsletters until unsubscription; analytics data retained for 30 days to 14 months per service
|
Section 15
|
|
Events and webinars
|
Registration, implementation, documentation
|
Article 6(1)(b) and (f) of the GDPR; photographs: partly (a)
|
Until the end of the event; 10 years where there is a statutory retention obligation
|
Section 16
|
|
Applications
|
Conduct of the application process
|
Article 6(1)(b) of the GDPR, Section 26 of the BDSG
|
6 months after the conclusion of the proceedings
|
Section 17
|
|
Social media
|
Information and communication on company websites
|
Article 6(1)(f) of the GDPR
|
No storage in our own systems
|
Section 18
|
|
Embedded content
|
Video playback
|
Article 6(1)(a) of the GDPR, Section 25(1) of the TDDDG
|
By provider
|
Section 19
|
|
Other services
|
Remote maintenance in support
|
Article 6(1)(b) of the GDPR
|
For the duration of the meeting
|
Section 20
|
We will only share your data if it is necessary for the purposes stated. Recipients include
You can find out which recipients are involved in each specific case in sections 13 through 20 for the respective services.
You have the following rights with respect to us, which you may exercise at any time using the contact information provided in Sections 1 and 2
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the State Data Protection Commissioner of Lower Saxony, Prinzenstraße 5, 30159 Hanover, www.lfd.niedersachsen.de. You may also contact the supervisory authority in your place of residence.
Right to Object under Article 21 of the GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
If your data is processed for direct marketing purposes, you may object to this processing at any time. We will then no longer process your data for these purposes.
Please send your objection to contact@wattkraft.com or to the address provided in Section 1.
We use cookies and similar technologies—that is, small files or pieces of information that are stored on or retrieved from your device. We distinguish between two categories.
Technically necessary technologies are required for the operation of the website, such as to store your language selection, your cookie settings, or to protect forms. The legal basis is Section 25(2)(2) of the TDDDG; for the subsequent processing of personal data, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest is the secure and functional operation of the website.
We use non-essential technologies only with your consent, such as for web analytics, marketing, and external media. The legal basis is Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. These services will not be loaded without your consent.
You make your selection during your first visit via the consent banner. There, you can individually select the categories “Essential,” “Statistics,” “Marketing,” and “External Media.” You can change your selection at any time via the cookie icon at the bottom of the website.
Borlabs Cookie (Consent Management)
Provider: Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany. The tool runs entirely on our server; no data is transmitted to Borlabs.
Data Categories: Your cookie settings, a randomly generated consent ID, time of consent, banner version, domain, and website path
Purpose: To obtain, store, and document your consent to cookies and similar technologies.
Legal basis: Section 25(2)(2) TDDDG, Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (proof of consent)
Retention period: The “borlabs-cookie” cookie is stored for one year. The proof of consent is deleted three years after the consent expires (statute of limitations pursuant to §§ 195, 199 BGB).
Transfer to Third Countries: No transfer to third countries.
Data Processing by a Third Party: Not required, as no data is transferred to the provider.
Hosting and Server Log Files
Provider: DSI GmbH Daten Service Informationssysteme, Carolinenstraße 1, 01097 Dresden, Germany
Data Categories: IP address, browser type and version, operating system, Internet service provider, date and time of access, page accessed, previously visited page (referrer URL), amount of data transferred, status code
Purpose: Delivering the website to your device, ensuring stability and security, detecting and defending against attacks, and analyzing errors.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the website.
Retention period: Log files are deleted after seven days. Longer retention occurs only in anonymized form or, in the event of a specific security incident, until the incident is resolved.
Transfer to Third Countries: No transfer to third countries. The servers are located in Germany.
Data Processing: A data processing agreement exists in accordance with Art. 28 of the GDPR.
Content Management System and Plugins
Provider: The website is based on WordPress and is maintained by our web agency. The plugins used for content management, image optimization, search engine optimization, data backup, and multilingual support run on our server.
Data Categories: No additional personal data is collected when using the website. Data backups contain the website’s content and the data stored therein, such as user accounts.
Purpose: Maintenance and presentation of content, optimization of images and loading times, and recovery following technical malfunctions.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the reliable operation of the website and protection against data loss.
Retention Period: Transfers to Third Countries: No transfers to third countries.
Data Processing on Behalf of the Controller: We have a contract with the web agency for data processing on behalf of the controller in accordance with Art. 28 of the GDPR.
Google reCAPTCHA
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Data Categories: IP address, browser type and version, operating system, screen resolution, language settings, mouse movements and keyboard inputs on the page, time spent on the page, cookies set by Google, and—if a Google Account is used—association with that account
Purpose: To distinguish between humans and automated programs when submitting forms, to protect against spam and abuse.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The service is not loaded until you have given your consent in the consent banner.
Retention period: We do not store any data from the service. The retention period at Google is governed by its Privacy Policy at policies.google.com/privacy.
Transfer to third countries: United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). In addition, the EU Commission’s Standard Contractual Clauses apply.
Data Processing: Google processes the data as a separate data controller. There is no data processing agreement in place.
In this section, we describe how we process your data when you contact us or use our support services. The general provisions in sections 9 through 12 apply.
Contact Form and Email
Provider: The contact form is provided by the WordPress plugin Contact Form 7, which runs on our server. Messages are delivered to our email inbox via an email delivery service.
Data Categories: Company, Street, ZIP Code, City, Email Address, Phone Number, Desired Recipient (Department), Subject, Customer Number (optional), Message Content, Time of Submission, IP Address. For email contact, the information you provide.
Purpose: Processing and responding to your inquiry, associating it with an existing customer relationship, and protecting the form from misuse.
Legal basis: Art. 6(1)(b) GDPR, if your inquiry relates to or initiates a contract. In all other cases, Art. 6(1)(f) GDPR. Our legitimate interest is to respond to your inquiry.
Retention period: Transfers to third countries: No transfers to third countries.
Data Processing: We have a data processing agreement with the email service provider in accordance with Art. 28 GDPR.
Zendesk (Customer Support)
Provider: Zendesk, Inc., 989 Market Street, San Francisco, CA 94103, USA
Data categories: Name, company, email address, phone number, equipment and product data, order or serial numbers, content and history of communication, attachments
Purpose: Structured handling of support, complaint, and service cases; documentation of warranty and guarantee claims; quality assurance.
Legal basis: Article 6(1)(b) of the GDPR for contract-related processing; otherwise, Article 6(1)(f) GDPR. Our legitimate interest is the efficient and transparent handling of your request. For statutory retention obligations, Art. 6(1)(c) GDPR.
Retention period: Tickets not related to commercial or tax law are deleted twelve months after resolution. Tickets regarding warranty or guarantee claims are stored until the respective period expires; in the case of extended manufacturer warranties, this may be longer than ten years. In all other respects, the retention periods set forth in Section 11 apply.
Transfers to third countries: United States. Zendesk, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Article 45 of the GDPR). In addition, the European Commission’s Standard Contractual Clauses apply.
Data Processing: A data processing agreement pursuant to Article 28 of the GDPR is in place.
In this section, we describe the newsletter as well as the services used to analyze website usage and for advertising. We use all analytics and advertising services only with your consent, which you provide via the consent banner and may revoke in accordance with Section 9. The general provisions in Sections 9 through 12 apply.
Newsletter via Brevo
Provider: Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (parent company Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France)
Data Categories: Email address, first name, last name, company (optional), IP address, and time of registration and confirmation; newsletter open and click behavior; device and browser information
Purpose: To send our newsletter containing information about products, events, training sessions, and webinars; to verify your consent; and to analyze open and click-through rates to improve our content.
Legal basis: Art. 6(1)(a) of the GDPR. Subscription is handled via a double opt-in process, meaning we will not use your email address until you confirm via a link. Performance tracking is part of your consent.
Retention period: Your data will be stored until you unsubscribe. After you unsubscribe, we will add your email address to a block list to ensure you do not receive any further newsletters. We retain proof of your consent for three years after the consent expires (Sections 195, 199 of the German Civil Code (BGB)). Unconfirmed subscriptions are deleted after seven days.
Transfers to third countries: No transfers to third countries. Brevo processes the data in data centers within the EU.
Data Processing: A data processing agreement exists in accordance with Art. 28 of the GDPR.
Brevo Marketing Automation (Website Tracking)
Provider: Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany
Data Categories: Visitor ID in the sib_cuid cookie, IP address, pages visited, time and duration of the visit, link to your newsletter contact if you accessed the website via a newsletter link
Purpose: To associate your website visit with your newsletter subscription and to analyze which content interests you in order to tailor newsletter content accordingly.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The service is not loaded until you have consented to the “Marketing” category in the consent banner.
Retention period: The sib_cuid cookie is stored for six months. The visit data is deleted along with your newsletter subscription.
Transfer to Third Countries: No transfer to third countries.
Data Processing: A data processing agreement exists in accordance with Article 28 of the GDPR.
Microsoft Clarity
Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA)
Data categories: Mouse movements, clicks, scrolling behavior, keyboard inputs in unmasked fields, pages visited, time spent on the site, screen resolution, browser type and version, operating system, device type, truncated IP address, approximate location at the country level, visitor ID in the _clck and _clsk cookies
Purpose: Recording and analyzing user sessions (session recordings) and creating heatmaps to improve the website’s usability and identify errors.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The service is not loaded until you have consented to the “Statistics” category in the consent banner.
Retention period: The _clck cookie is stored for one year; the _clsk cookie is stored for one day. Session recordings are stored by Microsoft for 30 days; heatmaps and aggregated data are stored for up to 13 months.
Transfer to third countries: United States. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 of the GDPR). In addition, the European Commission’s Standard Contractual Clauses apply.
Data Processing: Microsoft’s Clarity Terms of Use, including the privacy provisions for data processing, apply to the provision of the service. Microsoft also uses data on its own responsibility to improve its services.
Google Tag Manager
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Data Categories: IP address, browser type, time of access. Tag Manager itself does not set any cookies or store any data; it loads the services described below in accordance with your consent.
Purpose: Centralized management and integration of analytics and marketing services on the website.
Legal basis: Art. 6(1)(f) GDPR for technical integration. Our legitimate interest is the centralized and error-free management of the services used. The services loaded via Tag Manager are triggered only with your consent.
Retention Period: No data is stored.
Transfer to Third Countries: United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). In addition, the EU Commission’s Standard Contractual Clauses apply.
Data Processing: A data processing agreement pursuant to Article 28 of the GDPR is in place.
Google Analytics 4
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Data Categories: Pseudonymous user ID in the _ga and _ga_(Property) cookies, truncated IP address, pages visited, time spent on the site, clicks on external links, downloads, scroll depth, search terms on the website, language selection, referrer URL, browser type, operating system, screen resolution, device type, approximate location (region), cross-device association if the user ID is enabled, demographic characteristics and interests from your Google Account if Google Signals is enabled
Purpose: Statistical analysis of our website’s usage, creation of reports on visitor numbers and usage patterns, improvement of our offerings, and creation of target groups for advertising.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The service is not loaded until you have consented to the “Statistics” category in the consent banner.
Retention period: The _ga cookie is stored for two years. User and event data are deleted by Google after two months.
Transfer to third countries: United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). In addition, the EU Commission’s Standard Contractual Clauses apply.
Data Processing: A data processing agreement in accordance with Article 28 of the GDPR is in place.
Google Ads (Conversion Tracking and Remarketing)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Data Categories: Cookie ID in the _gcl_au and IDE cookies, IP address, pages visited, ads displayed and clicked, browser and device information, and—if a Google Account exists—association with that account
Purpose: To measure whether visitors perform certain actions on our website after clicking on a Google ad, and to display advertisements to visitors of our website on other websites.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The service is not loaded until you have consented to the “Marketing” category in the consent banner.
Retention period: The cookies are stored for up to 13 months. Google anonymizes advertising data in server logs after 9 or 18 months.
Transfer to third countries: United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). In addition, the EU Commission’s Standard Contractual Clauses apply.
Data Processing: Google processes the data for advertising purposes as a separate data controller. The Google Ads Data Processing Terms apply to conversion tracking.
Meta Pixel
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (parent company Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA)
Data Categories: Cookie ID in the _fbp cookie, IP address, pages visited, actions on the website (such as form submissions), ads viewed and clicked, browser and device information, and, if a Facebook or Instagram account exists, association with that account
Purpose: To measure the effectiveness of our ads on Facebook and Instagram and to display advertisements to visitors of our website on these platforms (retargeting).
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. The service is not loaded until you have consented to the “Marketing” category in the consent banner. We are jointly responsible with Meta for the collection and transmission of data to Meta (Art. 26 GDPR); the agreement can be found at facebook.com/legal/controller_addendum.
Retention period: The _fbp cookie is stored for three months. Further storage by Meta is governed by Meta’s privacy policy at facebook.com/privacy/policy.
Transfer to a third country: United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). In addition, the EU Commission’s Standard Contractual Clauses apply.
Data Processing: After the data is transferred, Meta processes it as a separate data controller.
We offer events such as roadshows, experience days, and training sessions, as well as webinars. In this section, we describe how we process data during registration and event execution. The general provisions in Sections 9 through 12 apply.
Event Registration
Provider: WATTKRAFT GmbH & Co. KG; data processed in our own systems
Data Categories: Name, company, email address, phone number, selected event and date, and, if applicable, details regarding participation preferences
Purpose: Organization and conduct of the event, participant management, and sending information about the event.
Legal basis: Art. 6(1)(b) GDPR, as registration establishes a contract for participation.
Retention period: Participant data will be deleted twelve months after the event. Where invoices are involved, the time limits specified in Section 11 apply.
Transfer to third countries: No transfer to third countries.
Data processing by a third party: Not required.
Webinars with GoTo Webinar
Provider: GoTo Technologies Ireland Unlimited Company, The Reflector, 10 Hanover Quay, Dublin 2, D02 R573, Ireland (parent company GoTo Group, Inc., 333 Summer Street, Boston, MA 02210, USA)
Data categories: Name, email address, company, IP address, time of registration and participation, duration of participation, questions and comments in the chat, and audio and video when the microphone or camera is activated
Purpose: Registration, conduct, and follow-up of webinars and online training sessions.
Legal basis: Article 6(1)(b) of the GDPR for participation. For the recording of a webinar, we obtain your consent pursuant to Art. 6(1)(a) GDPR.
Retention period: Registration data is deleted twelve months after the webinar. Recordings are deleted as soon as they are no longer needed, at the latest after two years.
Transfers to third countries: United States. GoTo Group, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Article 45 of the GDPR). In addition, the European Commission’s Standard Contractual Clauses apply.
Data Processing: A data processing agreement pursuant to Article 28 of the GDPR is in place.
Photos and Videos at Events
Provider: WATTKRAFT GmbH & Co. KG; processing takes place in the provider’s own systems
Data Categories: Photographs of participants; where applicable, name and company in captions
Purpose: To document our events and report on them on our website, in our newsletter, and on social media.
Legal basis: For overview shots in which individual persons are not the focal point, Article 6(1)(f) of the GDPR. Our legitimate interest is public relations. For photos in which you are clearly the focal point, we will obtain your consent in accordance with Article 6(1)(a) of the GDPR. We will notify you of the photography during the event.
Retention period: Published images remain online until the post is removed or you object to their use. We delete unpublished images twelve months after the event.
Transfers to Third Countries: No transfers to third countries, except for publication on social media (Section 18).
Processing on Behalf of a Third Party: Not required.
You can apply for our job openings by email at bewerbung@wattkraft.com. The general provisions in sections 9 through 12 apply.
Application via Email
Data Controller: WATTKRAFT GmbH & Co. KG; processed in our own systems
Data Categories: Name, contact information, cover letter, resume, certificates, and any other documents or information you submit
Purpose: To conduct the application process and decide whether to establish an employment relationship.
Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 88 GDPR and § 26(1) BDSG. To include you in a candidate pool beyond the specific application process, we will obtain your consent pursuant to Article 6(1)(a) of the GDPR.
Retention period: Application documents will be deleted six months after the conclusion of the application process so that we can defend against claims under the General Equal Treatment Act. If you are hired, the documents will be transferred to your personnel file.
Transfers to Third Countries: No transfers to third countries.
Data Processing by Third Parties: Not required.
We operate company pages on Facebook, Instagram, LinkedIn, YouTube, and XING. From our website, we only provide links to these pages; we do not embed any plugins from these networks. When you click on a link, you will leave our website. The general provisions in Sections 9 through 12 apply.
When you visit or interact with our company pages, the respective provider processes your data under its own responsibility—including your profile, posts, comments, reactions, and usage data. We receive aggregated statistics from Facebook, Instagram, and LinkedIn regarding the use of our pages (Page Insights). We are jointly responsible with the provider for the collection of this data (Art. 26 GDPR). The relevant agreements can be found at facebook.com/legal/terms/page_controller_addendum and legal.linkedin.com/pages-joint-controller-addendum.
We use our company pages to provide information about products, services, and events and to communicate with prospective customers and clients. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest is public relations and communication with you. If the communication is aimed at entering into a contract, the legal basis is Article 6(1)(b) of the GDPR. We do not store data from the company pages in our own systems, with the exception of inquiries that we take on for processing (Section 14).
These providers also process data in the United States. Meta Platforms, Inc., LinkedIn Corporation, and Google LLC are certified under the EU-U.S. Data Privacy Framework. For more information and your privacy settings, please refer to the providers’ privacy policies
On some pages, we embed third-party content. This content is not loaded until you have agreed to the consent banner under the “External Media” category or have individually approved the content. Before that, you will see a placeholder. The general provisions in Sections 9 through 12 apply.
YouTube Videos
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Data Categories: IP address, page accessed, time of access, browser and device information, interaction with the video, association with a Google account if one exists, cookies set by YouTube
Purpose: Display of product and event videos on our website.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
Retention period: We do not store any data. The retention period at Google is governed by its Privacy Policy at policies.google.com/privacy.
Transfer to third countries: United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR). In addition, the European Commission’s Standard Contractual Clauses apply.
Data processing: Google processes the data as a separate data controller.
In this section, we describe additional services we offer in connection with the website. The general provisions in Sections 9 through 12 apply.
Remote Maintenance with pcvisit
Provider: pcvisit Software AG, Schandauer Straße 34, 01309 Dresden, Germany
Data Categories: Screen content of your device for the duration of the session, IP address, session ID, device name, time and duration of the session
Purpose: Technical assistance provided by our support team via remote access to your device, if you request this during a support case and launch the support module via the link in the Download Center.
Legal basis: Art. 6(1)(b) GDPR, as remote maintenance is part of our service offering. The session will only begin if you run the module and grant access.
Retention period: Session data is deleted upon completion of the session. Connection logs are deleted after 30 days.
Transfer to third countries: No transfer to third countries. The servers are located in Germany.
Data processing: A data processing agreement in accordance with Article 28 of the GDPR is in place.