Privacy policy

1. Controller

Wittbix Value GmbH, represented by its managing director Dr. Tobias S. Witte, Milchstraße 15, 26123 Oldenburg, Germany
Phone: +49 179 7597905
E-mail: hello@wittbix.com

No data protection officer has been appointed, as the statutory requirements for this do not apply.

2. General information on data processing

We process personal data only insofar as this is necessary to provide a functioning website and our content and services, or where you have given your consent. The legal bases are the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data is any data that can be related to you personally. Use of this website is generally possible without providing personal data.

3. Hosting and server log files

This website is hosted by an external service provider:
STRATO GmbH. Registered office: Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Phone: +49 (0) 30-300 146 0.

When the website is accessed, the host automatically collects information in so-called server log files:

• IP address of the requesting device
• Date and time of the request
• Name and URL of the file accessed
• Volume of data transferred and notification of successful retrieval
• Browser type and version used
• Operating system
• Referrer URL (the previously visited page)

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in technically error-free operation, the security of our systems and the prevention of attacks. This data is not merged with other data sources.

Storage period according to STRATO: Web server log files are stored for six weeks; the IP addresses in them are anonymized. To detect and prevent attacks, STRATO stores IP addresses for a maximum of seven days. Error logs are stored for 24 hours to five days. Where storage is necessary to investigate a specific security incident, the data concerned will be retained until the matter has been conclusively resolved.

A data processing agreement pursuant to Art. 28 GDPR is in place with the host.

4. Appointment booking via Microsoft Bookings

We use Microsoft Bookings, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, for scheduling appointments. We link to our booking page. Data is only transmitted to Microsoft once you click the link.

When you make a booking, we process the data you enter: name, company, contact details, preferred appointment time, and your request. The legal basis is Art. 6 (1) (b) GDPR. Microsoft acts as a processor on the basis of the Microsoft Data Protection Addendum pursuant to Art. 28 GDPR.

Microsoft may also process data in the USA. Microsoft Corporation is certified under the EU-US Data Privacy Framework; the transfer is therefore based on the adequacy decision of the European Commission (Art. 45 GDPR). Further information: https://privacy.microsoft.com/en-us/privacystatement

5. E-mail, telephone and calendar

We use Microsoft 365, a service of Microsoft Ireland Operations Limited (address see section 4), for e-mail and calendar. Microsoft acts as a processor pursuant to Art. 28 GDPR. Section 4 applies to processing in the USA.

If you contact us by e-mail or telephone, we process the information you provide, including your contact details.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in responding.

6. Contact management with HubSpot

We use HubSpot, a service of HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland (parent company: HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA), to manage our business contacts (CRM).

If you contact us by e-mail or telephone or book an appointment, we store your name, your company, your contact details and information about our communication with you in HubSpot.

The legal basis is Art. 6 (1) (b) GDPR where this relates to the initiation or performance of a contract, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in the orderly management of our business contacts.

HubSpot acts as a processor pursuant to Art. 28 GDPR. For transfers to the USA, HubSpot names its certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, standard contractual clauses (Art. 46 (2) (c) GDPR). Further information: https://legal.hubspot.com/privacy-policy

7. Cookies and consent

Cookies are small text files stored on your device.

We use technically necessary cookies on the basis of § 25 (2) no. 2 TDDDG without your consent. This includes the cookie "wittbix_consent". It stores your choice in the cookie bar ("Agree" or "Necessary only") in your browser for twelve months. We do not store your choice on our server. The legal basis for the subsequent processing is Art. 6 (1) (f) GDPR.

We load Google Analytics (section 8) and the HubSpot tracking code (section 9) only with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Before you give consent, the website loads none of these scripts.

You may withdraw your consent at any time with effect for the future: Click "Cookie settings" in the footer and choose "Necessary only". The website then deletes the Google Analytics and HubSpot cookies as far as this is technically possible. You can also disable or delete cookies in your browser. This may limit the functionality of this website.

8. Web analytics with Google Analytics

With your consent, we use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics shows us how visitors use our website, for example which pages they visit. For this purpose, Google Analytics sets cookies (for example "_ga") and processes information about your device, your browser and your use of this website.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You may withdraw it at any time (section 7).

Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is therefore based on the adequacy decision of the European Commission (Art. 45 GDPR).

Google Analytics deletes the data after 14 months. We have set this retention period in Google Analytics. Further information: https://policies.google.com/privacy

9. Tracking with HubSpot

With your consent, we embed the HubSpot tracking code (provider see section 6). HubSpot then sets cookies (for example "hubspotutk" and "__hstc") and records which pages of this website you visit. If HubSpot recognizes you as a contact in our CRM, for example after you click a link in an e-mail from us, HubSpot may assign these page views to your contact record.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You may withdraw it at any time (section 7). Section 6 applies to transfers to the USA. Further information on HubSpot cookies: https://knowledge.hubspot.com/privacy-and-consent/what-cookies-does-hubspot-set-in-a-visitor-s-browser

10. Fonts

The fonts of this website are stored on our server. When you access the website, no connection is made to Google Fonts or other font providers.

11. Links to social networks

We link to our social network profiles. These are simple links, not embedded content or plugins. Data is only transmitted to the respective provider once you click the link. The respective provider is responsible for processing on the linked platforms.

12. Recipients of your data

We only pass on your data insofar as this is necessary to fulfil the respective purpose. Recipients are:

• our hosting service provider STRATO (data processing)
• Microsoft as provider of our e-mail, calendar and booking infrastructure (data processing)
• HubSpot as provider of our CRM and, with your consent, of tracking (data processing)
• Google as provider of Google Analytics, only with your consent
• our tax advisors, insofar as matters are relevant for tax purposes
• authorities and courts, insofar as we are legally obliged

Data is not disclosed to third parties for advertising purposes.

13. Storage period

We delete personal data as soon as the purpose of processing no longer applies and no statutory retention obligation exists. We retain documents relevant under commercial and tax law in accordance with § 257 HGB and § 147 AO: commercial and business letters for six years, accounting vouchers for eight years, books and annual financial statements for ten years. Processing is limited in this respect to fulfilling these obligations (Art. 6 (1) (c) GDPR).

14. Your rights

You have the following rights vis-à-vis us:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, please use the contact details given in section 1. You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany.

15. Right to object

Where we process your data on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21 (1) GDPR).

If your data is processed for direct marketing purposes, you may object at any time without giving reasons. Your data will then no longer be used for these purposes (Art. 21 (2) and (3) GDPR).

Please send your objection informally to the contact details given in section 1.

16. Right to lodge a complaint

Without prejudice to any other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany

17. Encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar and by the padlock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.

18. Changes to this privacy policy

We will update this privacy policy whenever the legal situation or the services we use change. The version published here at any given time applies.

Last updated: 9 October 2026