Data Protection Information
With these data protection notices, we inform you about our handling of your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
The Controller responsible for data processing is WILKENWERK GmbH (hereinafter referred to as "we" or "us").
Contents
I. General Information
Contact
Legal Basis
Duration of Storage
Categories of Data Recipients
Data Transfer to Third Countries
Processing when Exercising Your Rights
Your Rights
Right to Object
Data Protection Officer
II. Data Processing on our Website
Processing of Server Log Files
Newsletter
Cookies
Consent Management Tool
Google Analytics
Cloudflare
III. Data Processing on our Social Media Pages
Visiting a Social Media Page
Communication via Social Media Pages
IV. Further Data Processing
Applications
Contacting Us
Customer and Interested Party Data
Use of Email Address for Marketing Purposes
I. General Information
1. Contact
If you have any questions or suggestions regarding this information or would like to contact us regarding the assertion of your rights, please direct your inquiry to:
Wilkenwerk GmbH Präsident-Krahn-Straße 18-19 22765 Hamburg Phone: +49 40 890 848 – 0 Email: info@wilkenwerk.de
2. Legal Basis
The data protection term "personal data" refers to all information relating to an identified or identifiable natural person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. Data processing by us only takes place on the basis of legal permission.
We process personal data:
Only with your consent (Section 25 (1) TDDDG or Art. 6 (1) lit. a GDPR)
For the performance of a contract to which you are a party or at your request to carry out pre-contractual measures (Art. 6 (1) lit. b GDPR)
For compliance with a legal obligation (Art. 6 (1) lit. c GDPR)
If the processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms which require the protection of personal data prevail (Art. 6 (1) lit. f GDPR)
If you apply for an open position at our company, we also process your personal data to decide on the establishment of an employment relationship (Section 26 (1) Sentence 1 BDSG or Art. 6 (1) lit. b GDPR).
3. Duration of Storage
Unless otherwise stated in the following notices, we store data only as long as necessary to achieve the processing purpose or for the fulfillment of our contractual or legal obligations. Such legal retention obligations may arise in particular from commercial or tax law regulations.
From the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for ten years.
Personal data present in commercial letters and contracts will be retained for six years.
Furthermore, we will retain data in connection with consents requiring proof as well as with complaints and claims for the duration of the statutory limitation periods.
Data stored for advertising purposes will be deleted if you object to processing for this purpose.
4. Categories of Data Recipients
We use processors within the scope of processing your data. The processing operations carried out by such processors include, for example, hosting, email dispatch, maintenance and support of IT systems, customer and order management, accounting and billing, marketing measures, or document and data media destruction.
A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. Processors do not use the data for their own purposes but carry out the data processing exclusively for the controller and are contractually obligated to guarantee suitable technical and organizational measures for data protection.
Furthermore, we may transmit your personal data to entities such as postal and delivery services, our house bank, tax consulting/auditing firms, or the tax authorities. Further recipients may result from the following notices.
5. Data Transfer to Third Countries
Our data processing may involve the transfer of certain personal data to third countries (countries in which the GDPR is not applicable law). Such a transfer takes place in a permissible manner if the European Commission has determined that an adequate level of data protection is provided in such a third country.
If such an adequacy decision by the European Commission is not available, a transfer to a third country will only take place if suitable safeguards according to Art. 46 GDPR are provided or if one of the requirements of Art. 49 GDPR is met. Unless an adequacy decision exists and unless otherwise stated below, we use the EU Standard Contractual Clauses as suitable safeguards. You have the option to receive or inspect a copy of these clauses (see Contact).
If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 (1) lit. a GDPR.
6. Processing when Exercising Your Rights
If you exercise your rights according to Art. 15 to 22 GDPR, we process the transmitted personal data for the purpose of implementing these rights by us and to be able to provide proof of this. Data stored for the purpose of providing information will only be processed for this purpose and for purposes of data protection control, and processing will otherwise be restricted in accordance with Art. 18 GDPR. These processing operations are based on the legal basis of Art. 6 (1) lit. c GDPR in conjunction with Art. 15 to 22 GDPR and Section 34 (2) BDSG.
7. Your Rights
As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:
Right of Access: According to Art. 15 GDPR and Section 34 BDSG, the right to request information as to whether and to what extent we process your personal data.
Right to Rectification: According to Art. 16 GDPR, the right to demand the rectification of your data.
Right to Erasure: According to Art. 17 GDPR and Section 35 BDSG, the right to demand the deletion of your data.
Right to Restriction: According to Art. 18 GDPR, the right to have the processing of your data restricted.
Right to Data Portability: According to Art. 20 GDPR, the right to receive the data you have provided to us in a structured, commonly used, and machine-readable format.
Right to Withdraw Consent: If you have given us separate consent, you can withdraw this at any time in accordance with Art. 7 (3) GDPR (the lawfulness of processing based on consent before its withdrawal remains unaffected).
Right to Lodge a Complaint: If you believe that the processing violates the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.
8. Right to Object
In accordance with Art. 21 (1) GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on the legal basis of Art. 6 (1) lit. e or f GDPR. If personal data concerning you is processed by us for the purpose of direct marketing, you may object to this processing at any time according to Art. 21 (2) and (3) GDPR.
9. Data Protection Officer
You can reach our data protection officer at the following contact details: Herting Oberbeck Datenschutz GmbH Hallerstr. 76, 20146 Hamburg https://www.datenschutzkanzlei.de Email: datenschutzbeauftragter@wilkenwerk.de
II. Data Processing on our Website
When using the website, we collect information that you provide yourself. In addition, certain information about your use of the website is automatically collected by us during your visit. In data protection law, the IP address is generally also considered personal data.
1. Processing of Server Log Files
When using our website for purely informational purposes, general information that your browser transmits to our server is initially stored automatically. This includes as standard: browser type/version, operating system used, page accessed, previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code.
Legal Basis: Art. 6 (1) lit. f GDPR (protection of our legitimate interests in the technical administration and security of the website).
Storage Duration: The stored data will be deleted after 14 days, unless there is a justified suspicion of illegal use based on concrete evidence. We are not able to identify you as a data subject based on the stored information.
2. Newsletter
We offer the possibility to subscribe to our newsletter on our website. After registering, we will regularly inform you about current news regarding our events and offers.
Procedure: Double Opt-In (verification of the email address via a confirmation link).
Legal Basis: Art. 6 (1) lit. a GDPR (consent).
Withdrawal: Possible at any time with effect for the future (e.g., via the "unsubscribe" link).
Proof Obligation: Storage of IP address, date, and time of registration according to Art. 6 (1) lit. c in conjunction with Art. 7 (1) GDPR.
Service Provider: For management, dispatch, and analysis, we use the service rapidmail from Rapid Mail Positive Group Deutschland GmbH (Germany). Your email address is transmitted to them.
3. Cookies
We use cookies and comparable technologies on our website. Cookies are small data sets that are stored by your browser when you visit a website. You have full control over the use of cookies through your browser settings. The use of cookies is partly technically necessary for the operation of the site and thus permissible without consent. Technically unnecessary cookies (e.g., for analysis and marketing purposes, including third-party cookies) are only used with your consent in accordance with Section 25 (1) TDDDG and, if applicable, Art. 6 (1) lit. a GDPR.
4. Consent Management Tool
This website uses a Consent Management Tool to control cookies and the processing of personal data. The consent banner allows you to grant or withdraw consents.
Legal Basis: Your consent within the meaning of Art. 6 (1) lit. a GDPR.
Documentation: Processing of information regarding the declaration of consent for proof purposes (Art. 6 (1) lit. c in conjunction with Art. 7 (1) GDPR).
You can withdraw your consent for cookies here: (...)
5. Google Analytics
We use the service Google Analytics from the provider Google Ireland Limited (Ireland, EU) on our website. With the help of this web analysis service, we collect and analyze data about user behavior. Google Analytics uses cookies and processes IP addresses, device identifiers, and interaction data (also cross-device and cross-session). Google Ireland processes this data on our behalf and may create pseudonymous usage profiles.
Legal Basis: Your consent (Art. 6 (1) lit. a GDPR), withdrawable via our Consent Management Tool.
IP Anonymization: We use Google Analytics only with activated IP anonymization. The shortening of the IP address takes place on servers in the EU.
Storage Duration: Data on user actions is stored for a period of 2 months and then automatically deleted.
Remarketing: We use Google Analytics advertising features for cross-device, interest-based ad targeting. With appropriate consent, Google links your web and app browsing history with your Google account for this purpose. Further information: www.google.com/policies/technologies/ads/.
6. Cloudflare
We use the Cloudflare service from Cloudflare Inc. (USA) on our website for security reasons to check whether form entries are made by a natural person.
Function: To integrate this, the processing and transmission of the IP address to Cloudflare is technically necessary to avert automated attacks.
Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest in the secure provision of the website).
Note: A transfer to the USA cannot be ruled out. Further info: https://www.cloudflare.com/privacypolicy/.
III. Data Processing on our Social Media Pages
We are represented on several social media platforms with a company page:
Instagram (Meta Platforms Ireland Limited, EU)
LinkedIn (LinkedIn Ireland Unlimited Company, EU)
YouTube (Google Ireland Limited, EU)
XING (NEW WORK SE, EU)
1. Visiting a Social Media Page
When you visit our pages, the platform operators primarily process your data as sole controllers (for details, see their privacy policies). Page Insights: The operators provide us with anonymized statistics ("Page Insights"). This processing is carried out by the operators and us as joint controllers.
Purpose & Legal Basis: Evaluation of actions on our page for improvement (Art. 6 (1) lit. f GDPR).
Agreements: We have concluded joint controller agreements (links to Meta, LinkedIn, XING below). For YouTube (Google), Google is generally the sole controller.
You can also assert your rights directly against the operators. For Page Insights on Meta and LinkedIn, the Irish Data Protection Commission is the lead supervisory authority.
2. Communication via Social Media Pages
If you contact us via our social media pages, we process data such as your username, contact details, or messages.
Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest in contacting inquiring persons).
We use software to manage our company pages. For certain inquiries via the comment function, the text and username are displayed via the software and transmitted to the software provider. This data is deleted once the inquiry is answered.
IV. Further Data Processing
1. Applications
If you apply to us, we process your data exclusively in connection with the employment process and the handling of your application.
Confidentiality: Only relevant contact persons process the data.
Storage Duration: In the event of a rejection, we retain the data for up to six months (for follow-up questions), unless statutory provisions preclude deletion or you have consented to longer storage.
Legal Basis: Section 26 (1) Sentence 1 BDSG or Art. 6 (1) lit. b GDPR.
2. Contacting Us
If you call us or contact us by email, we process the transmitted data to answer the inquiry.
Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest).
3. Customer and Interested Party Data
When contacting us as a customer or interested party, we process your data (master, contract, payment, communication data) to establish or perform the contractual relationship.
Additional Purposes: We also process this data for evaluation and marketing purposes to further develop our offers.
Legal Basis: Art. 6 (1) lit. f GDPR. Further processing may occur based on consent (Art. 6 (1) lit. a GDPR) or legal obligation (Art. 6 (1) lit. c GDPR).
4. Use of Email Address for Marketing Purposes
We may use the email address you provided when placing an order to inform you about similar products and services of our own.
Legal Basis: Section 7 (3) UWG (German Act Against Unfair Competition).
Objection: You can object to this at any time (without incurring costs other than the transmission costs according to the basic rates), e.g., via the unsubscribe link in the mailing or to info@wilkenwerk.de.
Status: [1.0, 11.02.2026]