Privacy policy

1. Controller

WEBinnovision GbR, represented by its partners Bastian Frenkel and Yusuf Arslan, Lorenzheider Weg 1a, 58339 Breckerfeld, Germany.
Email: info@webinnovision.de

2. Contact form

When you use our contact form, we process the details you provide (name, email address, optionally company and phone number, and your message) solely to handle your enquiry and to get in touch with you. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) or your consent (Art. 6(1)(a) GDPR). The data is stored in a database at Neon (EU region, Frankfurt) and deleted as soon as it is no longer needed to handle your enquiry and no statutory retention obligations apply.

3. Hosting

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you visit it, technically necessary server log files are processed (including IP address, date and time, the page requested and user agent) to keep the site secure and stable (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel; any transfer to the USA is safeguarded by standard contractual clauses. The website is delivered from the Frankfurt region. Server log files are deleted after seven days.

4. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and you can withdraw any consent you have given at any time with effect for the future. Complaints can be made to the competent supervisory authority; for North Rhine-Westphalia this is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

5. AI-assisted handling of enquiries

To handle your enquiry faster and better, we use AI-assisted systems. The content of your enquiry (in particular your message) may be transmitted for processing to Mistral AI SAS (Paris, France), which acts on our instructions and on our behalf. We expressly use the provider's European access point; the data is hosted in the European Union. Individual processing steps at the provider may temporarily run through sub-processors outside the EU; standard contractual clauses are in place for this. We have a data processing agreement with the provider under Art. 28 GDPR; your data is not used to train AI models (expressly switched off in our account).

Anything with an external effect, such as reply emails or quotes, is always checked and approved by a person before it is sent; there is no decision based solely on automated processing within the meaning of Art. 22 GDPR. The legal basis is Art. 6(1)(b) and (f) GDPR.

Labelling under the AI Act. The chat on this website is an AI system; it says so at the start of every conversation (Art. 50(1) of Regulation (EU) 2024/1689). Articles in our magazine that were written with the help of AI carry a visible note below the text (Art. 50(4)); we check them and take responsibility for them. You can read more about this under AI transparency.

6. Newsletter

If you sign up for our newsletter, we use your email address to send you information and practical tips. Sign-up uses a double opt-in procedure: after you enter your address in the form, we send you an email with a confirmation link. Only when you click this link do we add you to the mailing list. If you do not click it, you will not receive the newsletter; the unconfirmed entry is deleted automatically after 30 days. We store the time of your confirmation so that we can prove your consent (Art. 7(1) GDPR, § 7(2) no. 3 UWG, the German Act against Unfair Competition).

You can unsubscribe at any time with effect for the future, using the unsubscribe link at the end of every message or by simply telling us. Your entry is then deactivated; it remains stored so that you are not contacted again by mistake during a later import. The legal basis is your consent (Art. 6(1)(a) GDPR). The newsletter is sent through the same email account as the rest of our business correspondence (see the section “Sending emails”); no additional newsletter service provider is involved.

7. Visitor statistics

We count how often a page was viewed and which website the visit came from. All we store is a number per day, page path and origin: no IP address, no cookie, no identifier, no device characteristics. Individual people are not recognised, and this is not technically possible either; no personal reference arises. Of the referring address we only store the domain name, never the full address. Nothing is stored on or read from your device in the process (§ 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act, therefore does not apply). The legal basis for the processing is our legitimate interest in designing our website to meet demand (Art. 6(1)(f) GDPR). The figures are deleted automatically after 400 days at the latest. Independently of this, this request is also protected against mass requests; how that works is explained under number 15.

8. Cookies and consent

Without your consent, this website sets no cookies. On your first visit we ask you via a notice at the bottom of the screen. If you reject or do not decide at all, nothing is loaded and nothing is stored on your device. Only if you agree do we load the services listed below.

Your browser remembers your choice locally (localStorage, not a cookie). You can change or withdraw it at any time using the Cookie settings link at the bottom of the page; withdrawal takes effect for the future. Reject and Accept are the same size and look the same, so that the choice is genuinely free. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Google Analytics

With your consent we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand which of our pages are found and read, so that we can improve what we offer. This involves processing, among other things, the pages viewed, time spent on them, approximate location (country/region), device and browser, and the page you came from. Your IP address is shortened by Google and not stored.

Google sets cookies for this (including _ga and _ga_<ID>) with a lifetime of up to two years. Google deletes the collected data after 14 months. A transfer to Google LLC in the USA is possible; it is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 and additionally on standard contractual clauses. A data processing agreement under Art. 28 GDPR is in place.

You can withdraw consent to this tracking at any time via Cookie settings at the bottom of the page. Google also offers a browser add-on: tools.google.com/dlpage/gaoptout. More details are in Google's privacy policy.

9. Booking appointments

If you book an appointment through our website, we process the details you provide (name, email address, optionally phone and company, and what it is about) as well as the time you chose, in order to arrange, confirm and hold the appointment. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). If our Google Calendar is connected, we only read from it the times at which we are already busy, so that you are not offered times that are taken. Your details are not transmitted to Google in the process, and we do not store the content of other appointments.

10. Project planner, website check and checklist

The project planner is an enquiry form with guided questions. We process your answers (type of project, industry, goals, scope, timeframe) and your contact details solely to give you an assessment and to deal with your request (Art. 6(1)(b) GDPR).

For the website check you enter the address of the website and your email address, and your phone number if you wish. Our servers then call up the address you entered and evaluate publicly visible features (for example response time, page title, encryption, existing links); we also check whether a sitemap exists and request the file size of up to 15 embedded images. This is the same kind of request that every browser and every search engine makes; we identify ourselves with our own user agent. No login details are used and no non-public areas are accessed. We show you the result straight away and store it together with your contact details as an enquiry, so that we can get in touch and explain the results. The legal basis for the check is your request (Art. 6(1)(b) GDPR) and for contacting you your consent in the form (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Please only check websites you are responsible for or whose check you are entitled to request.

If you request the website checklist, we process your name and the contact method you chose (email or phone) to provide the document and to get in touch with you once afterwards (Art. 6(1)(b) and (f) GDPR). This does not sign you up for the newsletter.

11. Chat on the website

You can ask us questions via the chat. Only the messages you type are processed, in order to answer your question (Art. 6(1)(f) GDPR, interest in providing information quickly). Please do not enter any particularly sensitive data there. Section 5 applies accordingly to the processing, with one difference: the answers in the chat are generated automatically by the assistant, without a person reading them first. That is why the chat is expressly labelled as AI, and its answers are not binding.

12. Personal customer area

On request, existing customers receive a personal link to an overview of their appointments, quotes, invoices and ongoing requests. Access works via a random string in the address that cannot be guessed; no account is needed. The page is excluded from search engines. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We will switch off access at any time on request.

The customer area also contains a referral link for passing on. Anyone who sends an enquiry via such a link sees the name of the person who recommended us and is recorded by us with a note of who the recommendation came from. Nothing is passed on in the process: the person who recommended us receives no data about the new enquiry from us. At the start of a project, the customer area also contains a questionnaire; we process the answers solely to carry out the project (Art. 6(1)(b) GDPR).

13. Sending emails

To send our emails we use the mailbox of our provider 1&1 IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany). The provider processes the messages on our instructions and on our behalf; processing takes place in the EU.

14. Fonts and external content

All fonts are hosted on our own server. When you visit this website, your browser does not connect to Google Fonts or any other third-party provider. We do not embed maps, videos or social media widgets.

15. Protection against misuse

Our forms, the chat and the login are protected against automated mass requests and against password guessing. For this we derive a one-way value from your IP address (HMAC-SHA-256 with a server secret known only to us) and count how many requests arrive in a short time. The IP address itself is not stored, and it cannot be calculated back from the value. No personal profile is created from it; the value is used solely for counting.

The legal basis is our legitimate interest in operating our website securely and protecting it against misuse (Art. 6(1)(f) GDPR). The entries are deleted automatically after seven days at the latest.

16. Storage period

We only store personal data for as long as is necessary for the purpose in question. We delete enquiries and their history as soon as the matter is closed and no statutory obligations prevent this. Invoices and tax-relevant documents are subject to the statutory retention period of ten years (§ 147 AO, the German Fiscal Code); if you ask us to delete them, in these cases we remove the personal reference instead of deleting the document.