Webnity-X

Privacy Policy

This policy explains which personal data Webnity X processes, for what purposes, on which legal basis, and what rights you have.

Controller

The controller responsible for processing personal data on this website is:

  • Niklas Hass
  • Webnity X
  • Dechant-Heinrich-Meurers-Straße 27
  • 50129 Bergheim
  • Germany

Email: info@webnity-x.com

Phone: +49 176 2045 33 11

If you have any questions about privacy or the processing of your personal data, you can contact us at any time.

General information on data processing

We process personal data only to the extent necessary to operate our website, handle inquiries, carry out pre-contractual or contractual measures, or on the basis of consent you have provided.

The following sections explain which data is processed, for what purpose, on which legal basis, and for how long the data is stored.

Where we use service providers that process personal data on our behalf, they are engaged in accordance with applicable legal requirements.

Hosting and server log files

We host this website and the associated technical infrastructure with:

  • Hetzner Online GmbH
  • Industriestr. 25
  • 91710 Gunzenhausen
  • Germany

The servers used for Webnity X are located in Nuremberg, Germany.

When you access our website, technically necessary connection data is processed. This may include in particular:

  • IP address
  • date and time of access
  • page or resource requested
  • referrer URL
  • browser and user agent
  • operating system
  • HTTP status code
  • amount of data transferred

This processing is necessary to deliver the website technically, ensure its stability and security, and identify abusive access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and reliable operation of our website.

nginx access logs are stored for a maximum of 14 days and are then automatically deleted or overwritten.

Technical system logs on the server are also limited to a maximum of 14 days. Application logs for our Contact API do not contain form content or complete inquiry payloads.

Encrypted transmission and data security

Our website and our Contact API use encrypted HTTPS connections.

We take appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, and other unlawful processing.

These measures include access restrictions, encrypted transmission, server-side validation, size and rate limits, and data-minimized logging wherever possible.

However, absolute protection during data transmission over the internet cannot technically be guaranteed.

Contact form and project inquiries

You can send us a project inquiry through a multi-step contact form on our website.

Depending on the information you provide, we process in particular:

  • desired project goal
  • requested services
  • company
  • website, optional
  • desired project timeline
  • planned investment range
  • name
  • email address
  • phone number and country code, optional

We also process technically necessary metadata such as language, source page, submission time, and a technical submission ID.

Required fields are necessary so that we can properly review your inquiry and respond to you. Optional information does not need to be provided.

The data is transmitted in encrypted form to our own Contact API at api.webnity-x.com. The API runs on a Hetzner server operated by us in Nuremberg, Germany.

The Contact API does not store the content of your inquiry in a database or permanently in the file system. After successful validation, your inquiry is converted into an internal email.

The legal basis is Article 6(1)(b) GDPR where your inquiry relates to entering into a contract or taking pre-contractual steps.

For other business inquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in efficiently handling and responding to business inquiries.

Project inquiries that do not result in a contract are generally deleted no later than six months after the communication has ended, unless statutory retention obligations, the establishment, exercise, or defense of legal claims, or other legally permissible reasons require longer retention.

If a contractual relationship is established, the relevant data may be stored for longer as part of contract processing and in accordance with applicable statutory retention requirements.

Contact by email or phone

If you contact us by email or phone, we process the information you provide in order to handle your inquiry.

The legal basis is Article 6(1)(b) GDPR where your contact concerns entering into or performing a contract.

In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in handling business communications.

The retention principles described under "Contact form and project inquiries" apply accordingly.

Google Workspace and email processing

We use Google Workspace for our business email communications.

The provider for customers based in the European Economic Area is generally:

  • Google Ireland Limited
  • Gordon House
  • Barrow Street
  • Dublin 4
  • Ireland

Project inquiries submitted through our contact form are sent as internal emails to our Webnity X inbox after successful processing.

This may include the contact details, company information, project information, and—where available and legally permissible—source information provided with your inquiry.

Google Workspace is used solely to handle our business communications and project inquiries.

The legal basis corresponds to the legal basis applicable to the respective contact, in particular Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

Project inquiries that do not result in a contract are generally deleted no later than six months after the communication has ended, unless statutory obligations or other legally permissible reasons require longer retention.

Google uses infrastructure and subprocessors worldwide to provide its services. Processing of personal data outside the European Economic Area therefore cannot be completely excluded.

Further information on international data transfers can be found in the section "Data transfers to third countries."

Postal direct marketing and B2B outreach

In individual cases we contact companies and their business representatives by post in order to introduce our services and to initiate a business relationship.

The controller for this processing is Niklas Hass, Webnity X. The postal address and contact details are set out in the section "Controller".

Purpose and legal basis

The purpose of the processing is postal direct marketing and business development addressed to companies and their business representatives.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in approaching companies that may be interested in the services of Webnity X, and their business representatives, about those services.

Whether a specific approach is permissible is decided on a case-by-case basis. What matters is the balance between our interest and your interests, rights, and freedoms. We carry out this balancing test and document it internally.

Categories of personal data

Depending on the individual case, we process in particular:

  • name
  • role or position within the company
  • company
  • business postal address
  • where applicable, further publicly available business contact details

For this purpose we process business-related data only. We do not use data from your private sphere for postal outreach.

Source of the data

We do not obtain this data from you directly. It comes from publicly available business sources, in particular:

  • company websites
  • legal notice pages
  • public registers, such as the German commercial register
  • comparable publicly available business sources

Because we do not collect the data from you directly, we inform you about this processing and about your right to object no later than with our first approach.

Right to object to direct marketing

You may object to the processing of your personal data for direct marketing purposes at any time and free of charge. An informal message is sufficient, addressed to: niklas.hass@webnity-x.com Following your objection, we will no longer use your personal data for direct marketing.

You do not need to give reasons for this objection. It exists alongside the objection under Article 21(1) GDPR, which you may raise on grounds relating to your particular situation.

Retention

If an approach does not lead to a business relationship, we delete the contact data used for it no later than twelve months after the last contact.

If a business relationship arises, further storage follows the section "Contact form and project inquiries" and any statutory retention obligations.

After an objection, we continue to store the details required for it — usually name, company, and address — as a suppression record for as long as this is necessary to reliably prevent a renewed approach. We use these details for that purpose only.

Recipients

The data is processed within our own business correspondence.

If you send us an objection by email, your message is processed in our business mailbox. For details, see the section "Google Workspace and email processing".

Your rights

You have the rights described in the section "Your rights", in particular the rights of access, rectification, erasure, and restriction of processing. The right to lodge a complaint and the competent supervisory authority are set out in the section "Right to lodge a complaint with a data protection authority".

The right to data portability under Article 20 GDPR applies only to processing based on consent or on a contract and therefore does not apply to this processing.

Consent management and storage of your choices

We use our own consent system, allowing you to decide which optional features you want to enable.

We distinguish between:

  • Necessary
  • Functional
  • Analytics
  • Marketing

Your selection is stored locally in your browser so that we can respect your decision on subsequent page views.

For this purpose, we use the following Local Storage entry:

webnityx_consent_v1

The currently stored data set uses internal version 2 and includes, in particular, the time of your decision and the categories you selected.

Your selection is stored for a maximum of six months. After this period expires, or if our consent system changes materially, we will ask for your selection again.

This storage is necessary to technically implement your privacy choices and to take your decision into account in a verifiable manner.

Where this involves processing personal data, the processing is carried out to meet our legal accountability obligations under Article 6(1)(c) GDPR in conjunction with Article 5(2) and Article 7(1) GDPR.

Storage on your device is exempt from consent under Section 25(2) No. 2 TDDDG where it is necessary to provide the privacy settings you have expressly requested.

You can change your selection at any time via "Cookie Settings" in the footer.

Functional form draft

If you consent to the "Functional" category, we can store a started project inquiry locally in your browser.

For this purpose, we use:

webnityx_contact_draft_v3

The information you have already entered in the form and the current step may be stored.

A previous privacy checkbox, technical honeypot fields, and other information not required to resume the form are not stored.

The draft remains exclusively in your browser and is not sent to our server unless you submit the form.

The maximum storage period is 14 days from the last change.

The draft is deleted:

  • after the inquiry has been successfully submitted
  • when you withdraw Functional consent
  • when the storage period expires

The legal basis for storage and processing is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Settings. The lawfulness of processing carried out before withdrawal remains unaffected.

You can use the contact form in full even without this consent. Only the ability to resume a started draft in the same browser across multiple page views will not be available.

Appointment booking with Cal.com

For online appointment booking, we use Cal.com, a service provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. The booking module on our appointment page is only loaded after you have consented to the integration. When it is loaded, your IP address, browser and device information, and technical usage data may in particular be transmitted to Cal.com. If you book an appointment, Cal.com also processes the information you provide, in particular your name, email address, appointment details and, where applicable, other information you provide voluntarily, in order to provide and manage the appointment.

The integration of the external booking module is based on your consent pursuant to Art. 6(1)(a) GDPR and, insofar as information is stored on or read from your device, Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings.

If you schedule an appointment with us via Cal.com, the booking data you provide is processed for appointment organization and to take steps at your request prior to entering into a contract pursuant to Art. 6(1)(b) GDPR.

We have entered into a data processing agreement with Cal.com pursuant to Art. 28 GDPR.

Cal.com may process personal data in the United States. According to Cal.com, transfers from the European Economic Area are based in particular on the EU Standard Contractual Clauses or, where applicable, adequacy mechanisms such as the EU-U.S. Data Privacy Framework.

Further information on data protection at Cal.com is available at https://cal.com/privacy.

Source and first-touch attribution

If you consent to the "Marketing" category, we store information about your first entry to our website locally in your browser.

For this purpose, we use:

webnityx_contact_source_v1

The following information may be stored:

  • first page visited
  • time of first visit
  • referrer domain
  • utm_source
  • utm_medium
  • utm_campaign
  • utm_content
  • utm_term

The full referrer URL is not stored. Only the source domain is stored.

The maximum storage period is 14 days.

The purpose is to attribute a later project inquiry to a campaign or original source and to evaluate the effectiveness of our marketing activities.

The legal basis for persistent storage is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

If you do not consent to the Marketing category, no 14-day first-touch attribution is stored in your browser.

When a project inquiry is submitted, source information that is technically available during the current page view—for example current campaign parameters or the referrer domain—may be processed together with the specific inquiry regardless of persistent storage.

The legal basis for this one-time attribution of a specific project inquiry is Article 6(1)(f) GDPR. Our legitimate interest lies in understanding which of our marketing and sales activities generate specific business inquiries.

You may object to this processing at any time on grounds relating to your particular situation.

Source information is not transmitted to Google Analytics as custom parameters of our contact form events.

Google Tag Manager

We use Google Tag Manager provided by:

  • Google Ireland Limited
  • Gordon House
  • Barrow Street
  • Dublin 4
  • Ireland

Container ID:

GTM-NC9LNV4X

Google Tag Manager is used to technically manage approved analytics and, where applicable, marketing tags.

We use Tag Manager in a restrictive Basic Consent configuration.

Before the relevant consent is provided, Google Tag Manager is not loaded on our website. This means that no requests to Google Tag Manager or Google Analytics are made before your decision.

Tag Manager is loaded only when you have consented to at least one Google-related category—Analytics or Marketing. Which downstream services are actually permitted to process data continues to depend on your specific selection.

The local Functional category applies only to Webnity X features and, by itself, does not load any Google services.

In our configuration, Google Tag Manager itself does not set analytics cookies. Analytics cookies such as _ga or _ga_Q0KR9T7P4C are set by Google Analytics.

We use Google Consent Mode v2. It tells Google which categories you have granted:

  • analytics_storage — governs measurement with Google Analytics and follows your decision on the Analytics category.
  • ad_storage — governs advertising-related storage on your device and follows your decision on the Marketing category.
  • ad_user_data — governs whether advertising-related data may be sent to Google and follows the Marketing category.
  • ad_personalization — governs personalised advertising and follows the Marketing category.

Before you make a decision, every one of these signals is set to denied.

The legal basis for processing in connection with optional Google services is your consent under Article 6(1)(a) GDPR and—where information is stored on or accessed from your device—Section 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Settings.

Google Analytics 4

If you consent to the Analytics category, we use Google Analytics 4.

Provider:

  • Google Ireland Limited
  • Gordon House
  • Barrow Street
  • Dublin 4
  • Ireland

Measurement ID:

G-Q0KR9T7P4C

Google Analytics helps us understand how our website is used and which content is relevant to visitors.

Depending on your use of the website, the following data may be processed in particular:

  • pages viewed
  • time and duration of page views
  • technical browser and device information
  • approximate geographic location
  • referrer information
  • campaign parameters contained in a visited URL
  • interactions with our website
  • technical event data

For our contact form, we also use our own technical events, for example for starting the form, moving between steps, and successfully submitting an inquiry.

No form values entered by you are transmitted to Google Analytics.

In particular, our custom contact form events do not transmit:

  • name
  • email address
  • phone number
  • company
  • website
  • selected services
  • project goal
  • timeline
  • budget
  • submission ID
  • first-touch data

Our custom contact form events contain only approved technical parameters such as form ID, form version, step ID, step number, or technical error category.

Campaign parameters may be processed by Google Analytics as part of normal page and traffic-source measurement where they are included in the URL visited. However, they are not enriched with the form information you enter.

Google Analytics uses the following first-party cookies in our configuration in particular:

_ga

Purpose: Distinguishing users.

Standard lifetime: up to 2 years.

_ga_Q0KR9T7P4C

Purpose: Storing session state.

Standard lifetime: up to 2 years.

Browsers may technically limit these lifetimes further.

The retention period for user and event data in our Google Analytics property is set to 14 months. Standard aggregated reports may technically remain unaffected by this setting.

Google states that IP addresses of users in the European Union are not logged or stored in Google Analytics. The IP address may be used to derive approximate location information and is then discarded.

We use Google Analytics only after you have provided consent.

The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Settings. When consent is withdrawn, we remove analytics cookies set by our website where technically possible.

Webnity X Analytics (our own analytics)

We use Webnity X Analytics, our own cookieless web analytics system. It helps us understand the reach and use of our website, identify where visits originate, and improve our website and marketing activities.

We are the controller and operator. The data is processed on a server we rent in Germany and is not passed on to third parties.

Processing location:

analytics.webnity-x.com

Webnity X Analytics helps us understand which pages are viewed and how visitors reach us.

The following data may be processed:

  • the page path requested, without query parameters
  • the title of the page requested
  • time of the visit and time actually spent visible
  • the host of the referring page, not the full address
  • campaign parameters that form part of a requested URL
  • device type, browser and operating system in broad categories
  • country, derived from the IP address
  • technical event data from our website

Webnity X Analytics does not set analytics cookies and does not use localStorage, sessionStorage, or a persistent client ID to recognize users.

No fingerprinting takes place: we do not collect canvas, font or WebGL characteristics.

When our website is accessed, technically generated connection data, in particular the IP address and user agent, is processed on the server. An HMAC-based identifier is derived from this data solely for the respective day. It is not designed to recognize a visitor across multiple days.

The IP address is used solely to derive the country and this daily identifier, and is discarded afterwards. It is not stored.

To associate events within a session, a random page-instance ID is generated for the currently opened document. It is not stored persistently on your device and does not survive a reload or a later browser visit.

UTM parameters may be processed for campaign attribution. For visits originating from Google Ads, Webnity X Analytics only detects that a Google click identifier (gclid) is present. The actual gclid value is not stored by Webnity X Analytics.

Form contents are not transmitted. In particular, we do not transmit:

  • name
  • email address
  • telephone number
  • company
  • free-text entries

Raw data is deleted after 180 days. Beyond that, we retain only daily totals without identifiers.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to perform privacy-conscious reach and usage analysis, technically optimize our website, and measure the effectiveness of our own marketing activities.

Webnity X Analytics is not used to create persistent user profiles or recognize visitors across multiple days.

Global Privacy Control (GPC) and Do Not Track (DNT) are respected. If either setting is enabled in the browser, Webnity X Analytics is not loaded.

You may object to this processing pursuant to Art. 21 GDPR. Please use the privacy contact address already provided in this Privacy Policy.

Meta Pixel: conversion measurement and audiences

If you consent to the Marketing category, we use the Meta Pixel.

Provider:

  • Meta Platforms Ireland Limited
  • Merrion Road
  • Dublin 4, D04 X2K5
  • Ireland

Pixel ID:

2127306207917196

We use the Meta Pixel for two purposes:

  • Conversion measurement: we record whether a visit that came through one of our ads on Facebook or Instagram led to a contact request.
  • Reach and audiences: we record page views to measure the effect of our ads and to show our ads on Facebook and Instagram to people who have visited our website.

The Meta Pixel is not loaded until you have consented to the Marketing category. Without that consent, no connection to Meta is established and no Meta cookie is set.

Meta processes in particular your IP address, information about your browser and device, the page visited, the referring page, and the time of the visit. If you are logged in to Facebook or Instagram, Meta may associate the visit with your account.

For conversion measurement we transmit only the fact that a request was submitted successfully, together with the technical form identifier.

In particular, we do not transmit:

  • name
  • email address
  • phone number
  • company name
  • free text from the form
  • timeline or budget details

The Meta Pixel uses the following first-party cookies in particular:

_fbp

Purpose: recognising the browser for ad measurement.

Lifetime: 90 days.

_fbc

Purpose: attributing a visit to an ad you clicked earlier. Only set if you reach our website through an ad link.

Lifetime: 90 days.

We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Article 26 GDPR). Any further processing is the sole responsibility of Meta. Meta provides the joint controller agreement:

Meta: Controller Addendum

Meta may transfer data to Meta Platforms, Inc. in the United States. According to Meta, Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; Meta states that it also relies on the European Commission's Standard Contractual Clauses.

More information on processing by Meta:

Meta Privacy Policy

The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw your consent at any time via Cookie Settings. When consent is withdrawn, we remove Meta cookies set by our website where technically possible and reload the page.

Cookies and Local Storage overview

An up-to-date overview of the cookies, Local Storage entries, providers, purposes, categories, and retention periods used on our website is available on:

Cookies & Tracking

/en/cookie-policy

You can also reopen Cookie Settings there at any time.

Local fonts and external content

The web fonts used on our website are served locally from our own server.

When our website loads, no connection is made to Google Fonts or comparable external font services.

Our website may contain links to external services, for example Cal.com, LinkedIn, or Google Maps. In the case of such plain links, a connection to the respective third-party provider is established only when you open them. In addition, we may embed clearly identified external content. The services used in each case and the associated data processing are described separately below.

From that point onward, the privacy policies of the respective external provider apply.

YouTube videos (two-click solution)

Some of our articles include videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

No connection to YouTube is established when the page loads. Initially, only a preview image served from our own server is shown. The YouTube player is loaded in privacy-enhanced mode from youtube-nocookie.com and the video starts only after you click "Play video".

When the player loads, in particular your IP address, browser and device information, the page you are viewing, and information about your use of the player are transmitted to Google. YouTube may use cookies or similar technologies on your device.

The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. You give it by clicking "Play video"; it applies only to that video and is not stored by us. Without a click, the video is not loaded.

Google may also process personal data in the United States. Information on such transfers can be found in the section "Data transfers to third countries". Further information on data protection at Google is available at https://policies.google.com/privacy.

Recipients and processors

Personal data is disclosed only to recipients where necessary for the purposes described or where a legal basis permits this.

The service providers we use include in particular:

  • Hetzner Online GmbH for hosting and server infrastructure
  • Google Ireland Limited or affiliated Google companies for Google Workspace
  • Google Ireland Limited for Google Tag Manager and Google Analytics where you have provided the required consent

Where a service provider processes personal data on our behalf, we enter into the required data processing agreements under Article 28 GDPR where legally required.

Data transfers to third countries

When Google services are used, processing of personal data outside the European Economic Area, particularly in the United States, cannot be completely excluded.

According to Google, Google LLC is certified under the EU-U.S. Data Privacy Framework. For transfers covered by the applicable adequacy decision, this framework may provide an appropriate legal basis for transfers of personal data to the United States.

Where a transfer cannot be based on an adequacy decision, Google states that it uses other appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses.

We use optional Google analytics or marketing services only after the required consent has been provided.

Retention periods

Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective purpose.

The data is then deleted unless statutory retention obligations, contractual requirements, or the establishment, exercise, or defense of legal claims justify longer storage.

Statutory retention periods remain unaffected.

Your rights

Subject to the applicable legal requirements, you have the following rights in particular:

  • right of access under Article 15 GDPR
  • right to rectification under Article 16 GDPR
  • right to erasure under Article 17 GDPR
  • right to restriction of processing under Article 18 GDPR
  • right to data portability under Article 20 GDPR
  • right to object under Article 21 GDPR
  • right to withdraw consent under Article 7(3) GDPR

To exercise your rights, an informal message to the following address is sufficient:

info@webnity-x.com

Withdrawal of consent and right to object

You may withdraw consent at any time with effect for the future.

For consent categories managed on our website, you can change your selection at any time via "Cookie Settings" in the footer.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right under Article 21 GDPR to object to such processing at any time on grounds relating to your particular situation.

We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Right to lodge a complaint with a data protection authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

The authority responsible for our registered place of business is in particular:

  • State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
  • Kavalleriestraße 2–4
  • 40213 Düsseldorf
  • Germany

Postal address:

  • Postfach 20 04 44
  • 40102 Düsseldorf
  • Germany

Automated decision-making

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place on this website where such decision-making would produce legal effects concerning you or similarly significantly affect you.

Changes to this Privacy Policy

We update this Privacy Policy when our website, the services we use, technical processes, or applicable legal requirements change.

The current version published on this website applies.

Last updated: October 23, 2026

Cookies?

We use essential technologies to keep this website running reliably. Analytics, functional and marketing services are only activated with your consent. Webnity X Analytics works without analytics cookies and independently of your choice.

Privacy PolicyCookie Details