Privacy Policy
Last updated: September 2026
The protection of your personal data is important to us. This privacy policy provides comprehensive information, in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG), about the nature, scope and purpose of the processing of personal data on this website.
1. Controller
The controller within the meaning of Art. 4 No. 7 GDPR is:
Well Project Management GmbH
Waldschneise 1, 24558 Henstedt-Ulzburg, Germany
represented by the management
Phone: +49 1625325599
Email: bewell@well-pm.com
We have not appointed a data protection officer, as the legal requirements (§ 38 BDSG) are not met. For all data protection matters, you can reach us using the contact details above.
2. What data we process
2.1 When visiting the website (server log files)
Each time our website is accessed, our system or hosting provider automatically collects data and information from the accessing device. The following data is collected:
| Data category | Purpose |
|---|---|
| IP address | Delivery of the website, detection and defence against attacks |
| Date and time of access | Ensuring proper operation |
| Name and URL of the retrieved file | Provision of content |
| Browser type and version, operating system | Compatibility and optimisation |
| Referrer URL (previously visited page) | Statistical evaluation, security |
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a stable, secure and functional website).
2.2 Contact (contact form and email)
If you contact us via the contact form or by email, we process the data you provide – usually name, email address and the content of your message – solely to process and respond to your enquiry.
Legal basis: Art. 6 (1) (b) GDPR (initiation of a contract) and Art. 6 (1) (f) GDPR (handling of your enquiry). The information is voluntary; however, without it we cannot process your enquiry.
2.3 Cookies and similar technologies
We use cookies and comparable technologies. Details of the individual cookies, categories and storage periods can be found in our Cookie Policy.
| Category | Purpose | Legal basis |
|---|---|---|
| Technically necessary (e.g. WPML language setting, CookieYes consent) | Basic website functions | § 25 (2) TDDDG; Art. 6 (1) (f) GDPR |
| Analytics (e.g. Google Analytics) | Reach measurement, optimisation | § 25 (1) TDDDG; Art. 6 (1) (a) GDPR (consent) |
3. Purposes and legal bases of processing
| Purpose | Data processed | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Provision and secure operation of the website | Server log files, IP address | (1) (f) – legitimate interest |
| Handling enquiries | Name, email, message content | (1) (b) / (f) |
| Reach analysis (statistics) | Usage data, pseudonymised IP | (1) (a) – consent |
| Compliance with legal obligations | depending on the case | (1) (c) – legal obligation |
| Establishment/defence of legal claims | depending on the case | (1) (f) – legitimate interest |
4. Recipients and processors (Art. 28 GDPR)
We only pass on personal data to carefully selected service providers with whom data processing agreements pursuant to Art. 28 GDPR are in place:
| Category | Service provider | Data processed |
|---|---|---|
| Hosting | IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany | Server log files, all data submitted via the website |
| CDN / caching | QUIC.cloud (LiteSpeed) | IP address, technical connection data |
| Cookie consent management | CookieYes | Consent data, truncated IP |
| Analytics, fonts, tag management | Google Ireland Limited (see section 5) | Usage data, IP address |
We do not sell, rent or trade your personal data. Disclosure to authorities only takes place where we are legally obliged to do so.
5. Google services and transfer to third countries
This website uses Google Fonts, Google Tag Manager and Google Analytics (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Analytics services and externally loaded fonts are only loaded after your consent. Data (in particular IP address and usage data) may be transferred to Google servers, including in the USA (Google LLC).
Safeguards for third-country transfers: The transfer takes place on the basis of your consent (Art. 6 (1) (a), Art. 49 (1) (a) GDPR), the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 and – where the provider is certified – the EU-US Data Privacy Framework. Google Analytics is operated with IP anonymisation. You can withdraw your consent at any time with effect for the future.
6. Retention period
| Type of data | Retention period |
|---|---|
| Server log files | short-term, then deletion or anonymisation |
| Contact enquiries | until final processing, unless statutory retention obligations apply |
| Business-relevant documents | statutory retention periods (generally 6 or 10 years under HGB/AO) |
| Analytics data | according to the configuration of the analytics service |
After the respective period has expired, the data is deleted or anonymised.
7. Data security (Art. 32 GDPR)
We take appropriate technical and organisational measures to protect your data, in particular:
- encrypted transmission via HTTPS/TLS;
- access restrictions and authorisation concepts;
- regular updating of the systems used;
- procedures for handling security incidents including notification obligations under Art. 33 and 34 GDPR.
Please note that data transmission over the internet may have security gaps; complete protection against access by third parties is not possible.
8. Your rights as a data subject
| Right | Article | Content |
|---|---|---|
| Access | Art. 15 GDPR | Information about the data stored about you |
| Rectification | Art. 16 GDPR | Correction of inaccurate or completion of your data |
| Erasure | Art. 17 GDPR | Deletion of your data, provided no retention obligation exists |
| Restriction | Art. 18 GDPR | Restriction of processing |
| Data portability | Art. 20 GDPR | Release in a structured, commonly used format |
| Objection | Art. 21 GDPR | Objection to processing based on legitimate interests |
| Withdrawal of consent | Art. 7 (3) GDPR | at any time with effect for the future |
| Complaint | Art. 77 GDPR | Complaint to a supervisory authority |
To exercise your rights, an informal message to bewell@well-pm.com is sufficient. Processing is generally free of charge for you and takes place within the statutory deadlines (Art. 12 GDPR).
9. Competent supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel, Germany
Web: https://www.datenschutzzentrum.de
10. No automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
11. Data protection for children
Our offer is aimed at businesses and traders, not at children. We do not knowingly collect personal data from persons under the age of 16 (Art. 8 GDPR).
12. Changes to this privacy policy
We will amend this privacy policy as soon as changes to the data processing or the legal situation make this necessary. The current version published on this page shall apply.
13. Contact
If you have any questions about the processing of your personal data, please contact: Well Project Management GmbH, Waldschneise 1, 24558 Henstedt-Ulzburg, email: bewell@well-pm.com.