Privacy policy

The controller under the General Data Protection Regulation (GDPR) is Christian Wenterodt, Webwand, Birkenweg 9, 21629 Neu Wulmstorf, Germany, email: hi@webwand.co, phone: +49 151 68152133. We have not appointed a data protection officer.

We only process personal data as far as needed to run the site, handle your order or answer your enquiries.

This site does not use analytics or tracking services or advertising networks and does not set tracking cookies. No profiling takes place.

We run the site and its systems with netcup GmbH (Karlsruhe, Germany) and Hostinger International Ltd. (Cyprus). We have a data processing agreement with both. When you open it, the server processes technically necessary data: IP address, date and time, requested page, browser type and operating system. This is required to deliver the site and keep it secure (Art. 6 (1)(f) GDPR). Logs are deleted after 30 days at the latest. Transfers are encrypted via HTTPS.

We store two things in your browser (localStorage), on your device only: the currency you chose and, while you fill in the briefing, your draft. Both are technically required for the function you asked for (§ 25 (2) no. 2 TDDDG) and are not sent to us until you submit the briefing. After you submit, we remove the draft from your browser. You can clear local storage at any time in your browser settings.

Fonts are delivered with the site itself. No connection to third-party font servers is made when you open a page.

Orders go through the checkout of our payment partner Creem (creem.io), which acts as Merchant of Record. Creem collects and processes the data needed for the purchase, such as name, email address, country, billing address and payment details, and is independently responsible for this. Creem's own privacy policy also applies. Creem may transfer data to countries outside the EU; the basis is the safeguards Creem names, such as standard contractual clauses.

From Creem we receive the details we need to fulfil the order: name, email address, country, order and subscription number, product, amount and currency, and status messages such as payment, refund or cancellation. The legal basis is performance of the contract (Art. 6 (1)(b) GDPR) and, for bookkeeping and tax, our legal obligation (Art. 6 (1)(c) GDPR).

When you click “Buy”, we also store a random order reference, the chosen plan, the currency, the language and the industry page you came from.

After the purchase you answer questions about your business, pages, content and design wishes. We store these details (for example company name, description, texts, contact email, links to logos and images, domain) and pass them internally to our order handling in order to build your website. For this we use automation software (n8n) and a database on our servers. The legal basis is performance of the contract (Art. 6 (1)(b) GDPR).

Please do not enter personal data of third parties in the briefing unless the website needs it. If you publish names, photos or contact details of employees, you need their consent or another legal basis.

When you write to us, we process your details to answer your request (Art. 6 (1)(b) or (f) GDPR). We delete them once the request is dealt with and no statutory retention duty applies.

If you book hosting, we run your website and, depending on the plan, your email mailbox on our servers. We then process the data arising through your website and mailbox as a processor. You remain responsible for operating your website, for example its own imprint and privacy policy. On request we conclude a data processing agreement with you.

Recipients of your data are only the service providers named above (hosting, Creem, automation software) and, where required by law, authorities. We do not pass on or sell data for advertising.

We keep order and invoice data for up to ten years because of tax and commercial law obligations. We keep briefing details while the project runs and warranty claims may arise; afterwards we delete them on request or when the periods have expired.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7 (3)). Write to us at hi@webwand.co.

You also have the right to lodge a complaint with a data protection authority. The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony.

Where we process data based on legitimate interests (Art. 6 (1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we show compelling legitimate grounds.

We update this policy when the site or the law changes. The version published here applies.