Webnity-X

Privacy Policy

This policy explains which personal data is processed when you visit this website, for what purposes, and on which legal basis.

Controller

The controller responsible for processing personal data on this website is:

  • Niklas Hass
  • Webnity X
  • Dechant-Heinrich-Meurers-Straße 27
  • 50129 Bergheim
  • Germany

Email: info@webnity-x.com

Phone: +49 176 2045 33 11

If you have any questions about privacy or the processing of your personal data, you can contact us at any time.

General information on data processing

We process personal data only to the extent necessary to operate our website, handle inquiries, carry out pre-contractual or contractual measures, or on the basis of consent you have provided.

The following sections explain which data is processed, for what purpose, on which legal basis, and for how long the data is stored.

Where we use service providers that process personal data on our behalf, they are engaged in accordance with applicable legal requirements.

Hosting and server log files

We host this website and the associated technical infrastructure with:

  • Hetzner Online GmbH
  • Industriestr. 25
  • 91710 Gunzenhausen
  • Germany

The servers used for Webnity X are located in Nuremberg, Germany.

When you access our website, technically necessary connection data is processed. This may include in particular:

  • IP address
  • date and time of access
  • page or resource requested
  • referrer URL
  • browser and user agent
  • operating system
  • HTTP status code
  • amount of data transferred

This processing is necessary to deliver the website technically, ensure its stability and security, and identify abusive access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and reliable operation of our website.

nginx access logs are stored for a maximum of 14 days and are then automatically deleted or overwritten.

Technical system logs on the server are also limited to a maximum of 14 days. Application logs for our Contact API do not contain form content or complete inquiry payloads.

Encrypted transmission and data security

Our website and our Contact API use encrypted HTTPS connections.

We take appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, and other unlawful processing.

These measures include access restrictions, encrypted transmission, server-side validation, size and rate limits, and data-minimized logging wherever possible.

However, absolute protection during data transmission over the internet cannot technically be guaranteed.

Contact form and project inquiries

You can send us a project inquiry through a multi-step contact form on our website.

Depending on the information you provide, we process in particular:

  • desired project goal
  • requested services
  • company
  • website, optional
  • desired project timeline
  • planned investment range
  • name
  • email address
  • phone number and country code, optional

We also process technically necessary metadata such as language, source page, submission time, and a technical submission ID.

Required fields are necessary so that we can properly review your inquiry and respond to you. Optional information does not need to be provided.

The data is transmitted in encrypted form to our own Contact API at api.webnity-x.com. The API runs on a Hetzner server operated by us in Nuremberg, Germany.

The Contact API does not store the content of your inquiry in a database or permanently in the file system. After successful validation, your inquiry is converted into an internal email.

The legal basis is Article 6(1)(b) GDPR where your inquiry relates to entering into a contract or taking pre-contractual steps.

For other business inquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in efficiently handling and responding to business inquiries.

Project inquiries that do not result in a contract are generally deleted no later than six months after the communication has ended, unless statutory retention obligations, the establishment, exercise, or defense of legal claims, or other legally permissible reasons require longer retention.

If a contractual relationship is established, the relevant data may be stored for longer as part of contract processing and in accordance with applicable statutory retention requirements.

Contact by email or phone

If you contact us by email or phone, we process the information you provide in order to handle your inquiry.

The legal basis is Article 6(1)(b) GDPR where your contact concerns entering into or performing a contract.

In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in handling business communications.

The retention principles described under "Contact form and project inquiries" apply accordingly.

Google Workspace and email processing

We use Google Workspace for our business email communications.

The provider for customers based in the European Economic Area is generally:

  • Google Ireland Limited
  • Gordon House
  • Barrow Street
  • Dublin 4
  • Ireland

Project inquiries submitted through our contact form are sent as internal emails to our Webnity X inbox after successful processing.

This may include the contact details, company information, project information, and—where available and legally permissible—source information provided with your inquiry.

Google Workspace is used solely to handle our business communications and project inquiries.

The legal basis corresponds to the legal basis applicable to the respective contact, in particular Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

Project inquiries that do not result in a contract are generally deleted no later than six months after the communication has ended, unless statutory obligations or other legally permissible reasons require longer retention.

Google uses infrastructure and subprocessors worldwide to provide its services. Processing of personal data outside the European Economic Area therefore cannot be completely excluded.

Further information on international data transfers can be found in the section "Data transfers to third countries."

Consent management and storage of your choices

We use our own consent system, allowing you to decide which optional features you want to enable.

We distinguish between:

  • Necessary
  • Functional
  • Analytics
  • Marketing

Your selection is stored locally in your browser so that we can respect your decision on subsequent page views.

For this purpose, we use the following Local Storage entry:

webnityx_consent_v1

The currently stored data set uses internal version 2 and includes, in particular, the time of your decision and the categories you selected.

Your selection is stored for a maximum of six months. After this period expires, or if our consent system changes materially, we will ask for your selection again.

This storage is necessary to technically implement your privacy choices and to take your decision into account in a verifiable manner.

Where this involves processing personal data, the processing is carried out to meet our legal accountability obligations under Article 6(1)(c) GDPR in conjunction with Article 5(2) and Article 7(1) GDPR.

Storage on your device is exempt from consent under Section 25(2) No. 2 TDDDG where it is necessary to provide the privacy settings you have expressly requested.

You can change your selection at any time via "Cookie Settings" in the footer.

Functional form draft

If you consent to the "Functional" category, we can store a started project inquiry locally in your browser.

For this purpose, we use:

webnityx_contact_draft_v3

The information you have already entered in the form and the current step may be stored.

A previous privacy checkbox, technical honeypot fields, and other information not required to resume the form are not stored.

The draft remains exclusively in your browser and is not sent to our server unless you submit the form.

The maximum storage period is 14 days from the last change.

The draft is deleted:

  • after the inquiry has been successfully submitted
  • when you withdraw Functional consent
  • when the storage period expires

The legal basis for storage and processing is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Settings. The lawfulness of processing carried out before withdrawal remains unaffected.

You can use the contact form in full even without this consent. Only the ability to resume a started draft in the same browser across multiple page views will not be available.

Source and first-touch attribution

If you consent to the "Marketing" category, we store information about your first entry to our website locally in your browser.

For this purpose, we use:

webnityx_contact_source_v1

The following information may be stored:

  • first page visited
  • time of first visit
  • referrer domain
  • utm_source
  • utm_medium
  • utm_campaign
  • utm_content
  • utm_term

The full referrer URL is not stored. Only the source domain is stored.

The maximum storage period is 14 days.

The purpose is to attribute a later project inquiry to a campaign or original source and to evaluate the effectiveness of our marketing activities.

The legal basis for persistent storage is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

If you do not consent to the Marketing category, no 14-day first-touch attribution is stored in your browser.

When a project inquiry is submitted, source information that is technically available during the current page view—for example current campaign parameters or the referrer domain—may be processed together with the specific inquiry regardless of persistent storage.

The legal basis for this one-time attribution of a specific project inquiry is Article 6(1)(f) GDPR. Our legitimate interest lies in understanding which of our marketing and sales activities generate specific business inquiries.

You may object to this processing at any time on grounds relating to your particular situation.

Source information is not transmitted to Google Analytics as custom parameters of our contact form events.

Google Tag Manager

We use Google Tag Manager provided by:

  • Google Ireland Limited
  • Gordon House
  • Barrow Street
  • Dublin 4
  • Ireland

Container ID:

GTM-NC9LNV4X

Google Tag Manager is used to technically manage approved analytics and, where applicable, marketing tags.

We use Tag Manager in a restrictive Basic Consent configuration.

Before the relevant consent is provided, Google Tag Manager is not loaded on our website. This means that no requests to Google Tag Manager or Google Analytics are made before your decision.

Tag Manager is loaded only when you have consented to at least one Google-related category—Analytics or Marketing. Which downstream services are actually permitted to process data continues to depend on your specific selection.

The local Functional category applies only to Webnity X features and, by itself, does not load any Google services.

In our configuration, Google Tag Manager itself does not set analytics cookies. Analytics cookies such as _ga or _ga_Q0KR9T7P4C are set by Google Analytics.

We use Google Consent Mode v2. It tells Google which categories you have granted:

  • analytics_storage — governs measurement with Google Analytics and follows your decision on the Analytics category.
  • ad_storage — governs advertising-related storage on your device and follows your decision on the Marketing category.
  • ad_user_data — governs whether advertising-related data may be sent to Google and follows the Marketing category.
  • ad_personalization — governs personalised advertising and follows the Marketing category.

Before you make a decision, every one of these signals is set to denied.

The legal basis for processing in connection with optional Google services is your consent under Article 6(1)(a) GDPR and—where information is stored on or accessed from your device—Section 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Settings.

Google Analytics 4

If you consent to the Analytics category, we use Google Analytics 4.

Provider:

  • Google Ireland Limited
  • Gordon House
  • Barrow Street
  • Dublin 4
  • Ireland

Measurement ID:

G-Q0KR9T7P4C

Google Analytics helps us understand how our website is used and which content is relevant to visitors.

Depending on your use of the website, the following data may be processed in particular:

  • pages viewed
  • time and duration of page views
  • technical browser and device information
  • approximate geographic location
  • referrer information
  • campaign parameters contained in a visited URL
  • interactions with our website
  • technical event data

For our contact form, we also use our own technical events, for example for starting the form, moving between steps, and successfully submitting an inquiry.

No form values entered by you are transmitted to Google Analytics.

In particular, our custom contact form events do not transmit:

  • name
  • email address
  • phone number
  • company
  • website
  • selected services
  • project goal
  • timeline
  • budget
  • submission ID
  • first-touch data

Our custom contact form events contain only approved technical parameters such as form ID, form version, step ID, step number, or technical error category.

Campaign parameters may be processed by Google Analytics as part of normal page and traffic-source measurement where they are included in the URL visited. However, they are not enriched with the form information you enter.

Google Analytics uses the following first-party cookies in our configuration in particular:

_ga

Purpose: Distinguishing users.

Standard lifetime: up to 2 years.

_ga_Q0KR9T7P4C

Purpose: Storing session state.

Standard lifetime: up to 2 years.

Browsers may technically limit these lifetimes further.

The retention period for user and event data in our Google Analytics property is set to 14 months. Standard aggregated reports may technically remain unaffected by this setting.

Google states that IP addresses of users in the European Union are not logged or stored in Google Analytics. The IP address may be used to derive approximate location information and is then discarded.

We use Google Analytics only after you have provided consent.

The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Settings. When consent is withdrawn, we remove analytics cookies set by our website where technically possible.

Cookies and Local Storage overview

An up-to-date overview of the cookies, Local Storage entries, providers, purposes, categories, and retention periods used on our website is available on:

Cookies & Tracking

/en/cookie-policy

You can also reopen Cookie Settings there at any time.

Local fonts and external content

The web fonts used on our website are served locally from our own server.

When our website loads, no connection is made to Google Fonts or comparable external font services.

Our website may contain links to external services, for example Cal.com, LinkedIn, or Google Maps.

These are links only and not embedded content. A connection to the respective third-party provider is generally established only when you choose to open the relevant link.

From that point onward, the privacy policies of the respective external provider apply.

Recipients and processors

Personal data is disclosed only to recipients where necessary for the purposes described or where a legal basis permits this.

The service providers we use include in particular:

  • Hetzner Online GmbH for hosting and server infrastructure
  • Google Ireland Limited or affiliated Google companies for Google Workspace
  • Google Ireland Limited for Google Tag Manager and Google Analytics where you have provided the required consent

Where a service provider processes personal data on our behalf, we enter into the required data processing agreements under Article 28 GDPR where legally required.

Data transfers to third countries

When Google services are used, processing of personal data outside the European Economic Area, particularly in the United States, cannot be completely excluded.

According to Google, Google LLC is certified under the EU-U.S. Data Privacy Framework. For transfers covered by the applicable adequacy decision, this framework may provide an appropriate legal basis for transfers of personal data to the United States.

Where a transfer cannot be based on an adequacy decision, Google states that it uses other appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses.

We use optional Google analytics or marketing services only after the required consent has been provided.

Retention periods

Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective purpose.

The data is then deleted unless statutory retention obligations, contractual requirements, or the establishment, exercise, or defense of legal claims justify longer storage.

Statutory retention periods remain unaffected.

Your rights

Subject to the applicable legal requirements, you have the following rights in particular:

  • right of access under Article 15 GDPR
  • right to rectification under Article 16 GDPR
  • right to erasure under Article 17 GDPR
  • right to restriction of processing under Article 18 GDPR
  • right to data portability under Article 20 GDPR
  • right to object under Article 21 GDPR
  • right to withdraw consent under Article 7(3) GDPR

To exercise your rights, an informal message to the following address is sufficient:

info@webnity-x.com

Withdrawal of consent and right to object

You may withdraw consent at any time with effect for the future.

For consent categories managed on our website, you can change your selection at any time via "Cookie Settings" in the footer.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right under Article 21 GDPR to object to such processing at any time on grounds relating to your particular situation.

We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Right to lodge a complaint with a data protection authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

The authority responsible for our registered place of business is in particular:

  • State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
  • Kavalleriestraße 2–4
  • 40213 Düsseldorf
  • Germany

Postal address:

  • Postfach 20 04 44
  • 40102 Düsseldorf
  • Germany

Automated decision-making

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place on this website where such decision-making would produce legal effects concerning you or similarly significantly affect you.

Changes to this Privacy Policy

We update this Privacy Policy when our website, the services we use, technical processes, or applicable legal requirements change.

The current version published on this website applies.

Last updated: September 15, 2026

Cookies & Privacy

We use necessary storage to keep this website working reliably. Analytics, convenience features, and marketing are activated only with your consent. Form data is not sent to Google Analytics.

Privacy PolicyCookie Details