Welcome to WÖHWA at steinexpo

Privacy Policy

1. Privacy at a glance

General information

This privacy policy explains which personal data we process in connection with our website, how we use it and what rights you have.

Personal data is information relating to an identified or identifiable person. Examples include names, email addresses and IP addresses.

Data processing on our website

WÖHWA GmbH is responsible for processing your data. You can find our contact details in section 3.

We receive data when you provide it to us, for example when contacting us, applying for a job or subscribing to our newsletter. When you visit our website, technical data required to provide and secure the website is also processed.

Your consent is required for additional functions, particularly certain external content and analytics and advertising services. The individual processing activities are explained in the following sections.

Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may also withdraw consent, object to certain processing and lodge a complaint with a data protection supervisory authority.

2. Hosting

Webflow

Our website is provided through Webflow. The provider is:

Webflow, Inc.

398 11th Street, 2nd Floor

San Francisco, CA 94103

USA

Webflow provides the infrastructure for our website and the form and search functions we use. Content delivery networks are also used to deliver pages, images, font files and other content.

This involves processing IP addresses, access times, requested content and browser and device information in particular. When you use forms or the website search, your respective entries are also processed.

The legal basis for the technical provision and security of the website is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website. The legal bases set out in sections 4 and 8 also apply to contact and application data.

Processing in the USA and by other service providers engaged by Webflow is possible. Webflow's data processing agreement includes provisions on international data transfers, including the EU Standard Contractual Clauses.

Further information:

Webflow privacy information: https://webflow.com/legal/privacy

Webflow data processing agreement: https://webflow.com/legal/dpa

3. General information and mandatory disclosures

Controller

WÖHWA GmbH

Öhringer Straße 6

74629 Pfedelbach

Germany

Telephone: +49 7941 9131-0

Email: info@woehwa.com

Data protection officer

You can contact our data protection officer at:

4MSysteme GmbH

Michael Schack

Gmünder Straße 65

73614 Schorndorf

Telephone: +49 7181 9695945

Email: datenschutz@woehwa.com

Legal bases

We process personal data on the following legal bases in particular:

Article 6(1)(a) GDPR, where you have given consent.
Article 6(1)(b) GDPR, where processing is necessary for a contract or for pre-contractual measures at your request.
Article 6(1)(c) GDPR, where we comply with legal obligations.
Article 6(1)(f) GDPR, where processing is necessary to safeguard legitimate interests and your overriding interests or fundamental rights do not take precedence.

The relevant statutory provisions, particularly section 26 of the German Federal Data Protection Act (BDSG), also apply to application and employment data.

Storing information on your device or accessing information already stored on it is also governed by section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Activities requiring consent are based on section 25(1) TDDDG. The exemption in section 25(2) TDDDG may apply to strictly necessary activities.

Retention periods

We retain personal data for as long as necessary for the relevant purpose. Specific periods are stated for individual processing activities.

Once the purpose no longer applies, data is erased unless statutory retention obligations or other lawful grounds justify further storage. These may include commercial and tax law obligations or the establishment and defence of legal claims.

Recipients of personal data

Within our company, only people who need personal data to perform their duties are given access.

Where necessary, we engage external service providers, for example for hosting, technical support, communications and newsletter distribution. Processing on our behalf is governed by the required data protection agreements.

Data may also be disclosed where necessary to perform a contract, required by law or permitted on another legal basis.

International data transfers

Certain services may involve the processing of personal data outside the European Union and the European Economic Area, particularly in the USA.

Such transfers must meet the requirements of Articles 44 et seq. GDPR. Applicable adequacy decisions or appropriate safeguards, such as the EU Standard Contractual Clauses, may provide the basis. Further information is provided under the respective services.

Withdrawal of consent

You may withdraw consent at any time with effect for the future. Processing carried out on the basis of that consent before its withdrawal remains lawful.

You can change consent for services on our website in the cookie settings. For other consent, please contact us using the details above. You can also unsubscribe from newsletters using the unsubscribe link.

Right to object under Article 21 GDPR

Where we process data on the basis of Article 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. This also applies to profiling based on those provisions.

Following such an objection, we will continue to process the data only if we can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or if processing serves the establishment or defence of legal claims.

You may object to processing for direct marketing at any time. This also applies to related profiling. Following your objection, we will no longer use the data for these purposes.

Other data subject rights

Subject to the respective statutory conditions, you may exercise the following rights:

Access to information on the processing of your personal data under Article 15 GDPR.
Rectification of inaccurate data and completion of incomplete data under Article 16 GDPR.
Erasure under Article 17 GDPR.
Restriction of processing under Article 18 GDPR, for example while disputed data or an objection is being examined.
Data portability under Article 20 GDPR, where processing is automated and based on consent or a contract.

To exercise your rights, please contact us or our data protection officer.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, your workplace or a suspected data protection infringement.

The supervisory authority responsible for our registered office is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg

https://www.baden-wuerttemberg.datenschutz.de/

Encrypted transmission

Our website uses HTTPS for encrypted transmission. You can identify an encrypted connection by “https://” in your browser's address bar.

Ordinary email cannot guarantee end-to-end confidentiality throughout the entire transmission route.

Unsolicited advertising

Our published contact details must not be used for unsolicited advertising without appropriate authorisation. We reserve the right to take legal action against unlawful use.

4. Data collection on this website

Cookies and similar technologies

Our website uses technically necessary functions and, depending on your choices, additional services. Cookies or similar technologies may be used.

Strictly necessary functions serve, for example, to provide the website securely and store your privacy choices. We obtain your consent for additional technologies requiring it.

Additional information on the cookies used, their providers, purposes and lifetimes is available in the cookie settings.

Consent management with Cookiebot

We use Cookiebot to manage and document your privacy choices. The provider is:

Usercentrics A/S

Havnegade 39

1058 Copenhagen

Denmark

Cookiebot processes your choices and the time they were made, together with technical information for attribution and documentation. This may include your IP address, browser information and a consent identifier.

Your choices are stored in your browser so that they can be taken into account on subsequent visits.

Processing serves to fulfil our legal obligations to obtain and demonstrate required consent. The legal basis is Article 6(1)(c) GDPR. Section 25(2) TDDDG applies to the strictly necessary storage of your choices on your device.

You can reopen and change your choices using the cookie settings accessible at the bottom left.

According to the provider, end-user data stored as part of the service is erased on a rolling basis twelve months after collection.

Further information:

Cookiebot privacy information: https://www.cookiebot.com/en/privacy-policy/

Technical access data

When you access our website, the hosting infrastructure processes technical data. This includes IP address, date and time, requested content, data volumes transferred, response status and browser, operating system and, where applicable, referrer details.

This processing serves to deliver the website, analyse errors and prevent attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

Retention depends on what is necessary for these purposes. In the event of security incidents, relevant data may be needed for longer for investigation and legal action.

Contact forms

When you contact us using a form, we process your entries, particularly your contact details and message, to handle your request and any necessary follow-up questions.

The forms are processed through Webflow. Your details are stored in Webflow and also transmitted to the recipient addresses configured for the respective form. Data may therefore be held in the form management system, our email inboxes and by the responsible people within our company.

For enquiries relating to a contract, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR. Our legitimate interest is the proper handling of incoming requests.

We retain the information for as long as necessary to handle your request and any necessary follow-up questions. The data and copies created for this purpose are then erased unless legal obligations or other lawful retention grounds prevent this.

Required information is marked in the respective form. Without the necessary information, we may be unable to handle your request.

Contact by email, telephone or fax

When you contact us through these channels, we process the information you provide to handle your request.

Where a contract is involved, processing is based on Article 6(1)(b) GDPR. Otherwise, Article 6(1)(f) GDPR applies on the basis of our legitimate interest in responding to your enquiry.

The retention principles for contact enquiries described above apply.

Website search

Our website uses Webflow's search function. When you search, the search term entered and the connection data required for technical processing are processed to display relevant content.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to make our content easier to find.

Please do not enter confidential information or personal details in the search field that are not necessary for your search.

Spam protection with Cloudflare Turnstile

Our forms use Cloudflare Turnstile to detect automated and abusive submissions. The provider is Cloudflare, Inc., USA.

This may involve processing IP addresses, browser and device characteristics, technical connection signals and information on interaction with the verification. These signals are used to assess whether a request is likely to originate from a person or an automated system.

The legal basis for protecting our forms is Article 6(1)(f) GDPR. Our legitimate interest is to prevent spam, attacks and misuse. Section 25(2) TDDDG applies to strictly necessary access to devices.

Processing in the USA is possible. Information on processing and the envisaged transfer mechanisms is available from the provider:

Cloudflare Turnstile privacy information: https://www.cloudflare.com/turnstile-privacy-policy/

5. Analytics tools and advertising

Planned use of Google services

We plan to use Google Analytics 4, Google Tag Manager and Google Ads with conversion tracking on our website. The following information describes these services and their intended use after activation.

The provider in each case is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by affiliated Google companies, particularly in the USA, is possible.

The planned analytics and advertising functions are intended to be used exclusively on the basis of your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to corresponding storage and access on your device.

You can withdraw your consent in the cookie settings.

Google Tag Manager

Google Tag Manager is intended to enable technical management of the analytics and advertising services used. It serves to trigger the respective services in accordance with your consent.

Technical connection data, including your IP address, may be transmitted to Google when the service loads. The actual analysis is performed by the services integrated through it.

Google Analytics 4

Google Analytics 4 is intended to help us understand how our website is used and improve its content and navigation.

In particular, page views, interactions, traffic sources, approximate geographical origin and browser and device information are to be analysed. Cookies or similar identifiers may associate visits and interactions with a browser or device.

A retention period of 14 months is planned for the user and event data available in Google Analytics. This setting applies to the corresponding detailed data. Aggregated statistical reports may remain available for longer.

Google Ads and conversion tracking

We plan to use Google Ads to run advertisements and measure their success.

Conversion tracking is intended to show whether particular actions take place on our website after interaction with an advertisement, for example a contact enquiry. Advertising identifiers, cookies and information about website actions may be processed for this purpose.

The analysis serves to assess the effectiveness of our advertising and improve campaigns.

Further information

Information on Google's data processing, international transfers and your settings options is available at:

Google privacy information: https://policies.google.com/privacy?hl=de

6. Newsletter

Planned newsletter distribution through Brevo

We plan to use Brevo to distribute our newsletter. The following information describes the planned subscription, distribution and analysis procedures.

The provider is:

Brevo GmbH

Köpenicker Straße 126

10179 Berlin

Germany

We intend to use the newsletter to provide information about our company, services, products and offers. We need your email address for subscription. Further information is voluntary where indicated as such in the subscription form.

Double opt-in subscription

A double opt-in procedure is planned for new subscriptions. After subscribing, you will receive an email with a confirmation link. Your address will be activated for newsletter distribution only after confirmation.

To document consent, the subscription and confirmation are recorded, including their times, the consent wording and associated technical evidence.

Distribution is based on your consent under Article 6(1)(a) GDPR in conjunction with the applicable rules on email advertising under competition law. Documentation serves to demonstrate consent.

Open and click analysis

We plan to analyse newsletter opens and link clicks. Retrieval information, times and interactions may be associated with a recipient address. Tracking pixels and specially configured links may be used for this purpose.

The analysis is intended to help us assess the relevance of our content and improve newsletters.

Personalised performance measurement is planned on the basis of corresponding consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to access to your device requiring consent.

Migration of existing newsletter contacts

We plan to migrate existing newsletter contacts from the previous distribution service Rapidmail to Brevo. Further distribution requires a valid legal basis. Existing consent records, unsubscribes and suppression records will be taken into account.

Unsubscribing and withdrawal

You may withdraw your consent at any time with effect for the future. You can use the unsubscribe link in every newsletter or contact us.

The lawfulness of processing carried out before withdrawal remains unaffected.

Retention periods

Data required for distribution is generally stored for the duration of the subscription. After unsubscribing, it is removed from the active mailing list.

Necessary consent records may be retained beyond this to comply with legal obligations or defend legal claims.

Your email address may remain on a suppression list where necessary to prevent further unwanted messages. This processing is based on Article 6(1)(f) GDPR and serves to respect your unsubscribe request. The need for retention is reviewed.

Processing by Brevo

Brevo is intended to manage recipients, distribute newsletters and carry out agreed performance measurement on our behalf. Other Brevo group companies and subprocessors may be involved.

Any transfers outside the EU or EEA must comply with legal requirements.

Further information:

Brevo privacy information: https://www.brevo.com/de/legal/privacypolicy/

7. Plugins and tools

YouTube

We use embedded YouTube videos on individual automation pages. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube thumbnails and video players are loaded only after you have consented to the corresponding processing through our consent management system. Without consent, this content is not retrieved from YouTube.

The video player uses privacy-enhanced mode through “youtube-nocookie.com”. This mode does not prevent all data transfers to Google.

After you consent, loading thumbnails and videos may involve processing your IP address, browser and device information and details of the content accessed. Playback also involves information about video usage. If you are signed in to Google, Google may be able to associate data with your account.

The purpose is to provide supplementary video presentations of our products and solutions.

The legal basis is Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to corresponding storage and access on your device.

You can withdraw your consent in the cookie settings. Processing carried out up to that point remains unaffected.

Processing by Google companies in the USA is possible.

Further information:

Google privacy information: https://policies.google.com/privacy?hl=de

Fonts

Our website uses licensed font files delivered through the Webflow infrastructure. The technical connection data required to retrieve these files is processed.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a consistent and easily readable presentation of our website.

The Google Fonts service is not integrated. The information on Webflow in section 2 also applies.

External links and social media profiles

Our website links to profiles on Facebook, Instagram, LinkedIn and YouTube and to other services, including our shop and service portal.

The social media references are ordinary links. No social media plugins or corresponding tracking pixels are integrated through them. The information above applies to embedded YouTube videos.

When you open an external link, further processing is governed by the privacy information of the respective service.

This privacy policy covers our corporate website. The separate shop and other linked services are subject to the privacy information published there.

8. Our own services

Handling job application data

You can apply for a job with us, particularly by email, post or through our online application form.

We process information required for the application procedure. This includes contact and communication data, qualifications, career history, submitted application documents and information from interviews.

Processing serves to assess your application and decide whether to establish an employment relationship. The legal basis is, in particular, section 26(1) BDSG. Where individual processing activities are based on separate voluntary consent, Article 6(1)(a) GDPR applies.

Within our company, only people involved in handling your application are given access.

Online applications and application documents

Our online application form is processed through Webflow. Submitted form information and uploaded application documents are stored in Webflow.

Form data is also transmitted to the configured recipient addresses. The responsible people process the application and associated documents to conduct the application procedure.

Application data may therefore be held in Webflow's form management system, email inboxes and internal application records.

The information on Webflow and form protection with Cloudflare Turnstile also applies to technical processing.

Providing your data is voluntary. Without the information necessary for the selection decision, we may be unable to consider your application.

Successful applications

If an employment relationship is established, we transfer the application data required for this purpose to personnel administration. Further processing follows the legal bases applicable to the employment relationship.

Retention after the application procedure

If no employment relationship is established, you decline a job offer or withdraw your application, we retain the application data for up to six months after the procedure ends.

This serves in particular to document our decisions and assess or defend potential legal claims. The legal basis is Article 6(1)(f) GDPR.

The data is then erased and paper documents destroyed. Longer retention occurs only where justified, for example by a specific legal dispute, a statutory obligation or separate consent.

Erasure covers records, uploaded files and working copies held for the application procedure, particularly in Webflow, email inboxes and internal records, unless lawful grounds for retention apply.