Privacy
Contents
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the member states and other data protection provisions is:Wunderwerkstatt UG (haftungsbeschränkt)Rietbüsche 5159872 MeschedeGermanyPhone: 02903 5599808Email: info@wunderwerkstatt.xyz
We are currently not legally required to appoint a data protection officer. However, you can contact us at any time using the contact details above with any questions about data protection.
2. General information on data processing
As a matter of principle, we only process our users' personal data to the extent necessary to provide a functional website as well as our content and services.As a rule, personal data is only processed with the consent of the data subject or where the processing is permitted by statutory provisions (in particular Art. 6 GDPR).Legal bases
Where we obtain consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.Where personal data is processed because it is necessary for the performance of a contract to which the data subject is party, or in order to take steps prior to entering into a contract, Art. 6(1)(b) GDPR serves as the legal basis.Where processing is necessary for compliance with a legal obligation to which we are subject, the processing is based on Art. 6(1)(c) GDPR.If processing is necessary for the purposes of a legitimate interest pursued by our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis.3. Provision of the website and server log files
Nature and scope of data processing
Each time our website is accessed, our hosting provider automatically collects data and information from the computer system of the accessing device and stores it in so-called server log files. This may include, among other things:– the IP address of the device,– the date and time of access,– the URL accessed or file retrieved,– the website from which access is made (referrer URL),– the browser and operating system used,– where applicable, the name of the access provider.This data is not attributed to any specific person. We do not combine this data with other data sources.Purpose of processing
Temporary storage of the IP address and the log files is necessary in order to– enable delivery of the website to your device,– ensure the ongoing functionality and security of our website,– analyze errors and fend off attacks.Legal basis
The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes stated above.Storage period
Log files are generally stored for a maximum of 30 days and then deleted, unless longer retention for evidentiary purposes is required in an individual case (e.g. in the event of security incidents).4. Contact via contact form, email, phone, AI chat or AI hotline
If you contact us via the contact form, by email, by phone, via our AI phone hotline or via the AI chat embedded on the website, we process the data you provide (e.g. name, contact details, content of your request) in order to handle your request.Purpose of processing
– processing of and responding to your request,– where applicable, initiating, performing or terminating contractual relationships,– improving our support and our services.Legal basis
The legal basis for processing the data is Art. 6(1)(b) GDPR, insofar as the contact takes place in the context of (pre-)contractual relationships (e.g. specific project requests).Otherwise, the processing is based on our legitimate interest in handling your request and in efficient communication with (potential) customers pursuant to Art. 6(1)(f) GDPR.Contact via the AI chat on the website
On our website, we occasionally provide a chat widget through which you can communicate in real time with an AI-powered assistant (chatbot). The texts you enter in the chat are transmitted to our technical service providers in order to generate automated responses and handle your request.In particular, the following data is processed:– chat content (your messages and responses generated by the system),– technical connection data (e.g. IP address, timestamp, where applicable browser/device information),– where applicable, contact details you provide voluntarily (e.g. name, email, phone number).The chat is provided via services of our processor for voice and AI technology (ElevenLabs). We have configured the services so that conversations are only used for the duration of technical processing and are not stored by the service provider as permanent conversation logs. Where we document conversation content or key results in our own systems (e.g. CRM, ticket system), this is done solely to follow up on and respond to your request.Depending on the context of your request, the legal basis is Art. 6(1)(b) GDPR (initiation/performance of a contract) or Art. 6(1)(f) GDPR (our legitimate interest in efficient support and prompt responses to requests).Contact via the AI phone hotline
We also offer an AI-powered phone hotline. When you call this hotline, the content of the conversation is automatically converted into text and processed by a language model in order to give you suitable answers or record your concern.When you use the hotline, the following data in particular may be processed:– your phone number and technical traffic data (e.g. time and duration of the call),– audio data of your voice (for the duration of the connection),– text transcripts generated from the audio stream,– where applicable, information you provide about your concern (e.g. project data, contact details).For speech processing (speech recognition, speech synthesis and routing of the conversation), we use a specialized processor, the provider ElevenLabs. The services we use are operated in so-called zero-retention mode. As things currently stand, this means that conversation data is only used transiently for the duration of technical processing and is not stored permanently by the service provider. We ourselves do not record conversations conducted via the AI hotline.Where we document conversation content or summarized notes in our own systems (e.g. in a CRM system or in project notes), this is done solely to handle your concern, to document project activities or to initiate or perform a contract.Here too, depending on the context, the legal basis is Art. 6(1)(b) GDPR (insofar as the request relates to an existing or prospective contract) and otherwise Art. 6(1)(f) GDPR (our legitimate interest in modern, more efficient customer communication and availability).Storage period
We store your requests (whether submitted via form, email, phone, AI chat or AI hotline) for as long as is necessary to handle them and any follow-up questions. Where a contractual relationship arises from the communication, we store the data in accordance with the statutory retention periods (in particular those under commercial and tax law).5. Use of local storage
We do not use tracking or third-party cookies. In particular, we do not use any analytics or marketing tools such as Google Analytics or similar.However, we use your browser's local storage function to provide certain convenience features. Small data entries are stored locally in your browser and are not sent to us or to third parties.What data is stored?
We only store:– the website language you have selected, if the site is offered in several languages (e.g. language=de),– the display variant or theme you have selected (e.g. theme=dark or theme=light).– the consent you have given to the use of the chat widget in accordance with our privacy policy.No user profiles are created, no IDs are assigned, no movement data is linked across multiple websites and no data is transmitted to third parties.Purpose of processing
The use of local storage serves solely to– save your language settings and theme preferences and– provide you with a user-friendly, consistent display of the website on later visits.Legal basis
The legal basis for the use of local storage is Art. 6(1)(f) GDPR. Our legitimate interest lies in a user-friendly and efficiently designed presentation of our website.Insofar as local storage entries are technically necessary to provide the functions you have requested, storage also takes place in accordance with the requirements of the German Telecommunications Digital Services Data Protection Act (TDDDG) for strictly necessary storage and access operations on your device.Storage period / your control
The local storage entries remain stored in your browser until you delete them. You can view and remove the stored data at any time via your browser settings, or restrict the use of local storage.6. Disclosure of data, data processing on our behalf and transfers to third countries
As a matter of principle, we only disclose your personal data to third parties– if this is necessary for the performance of a contract with you,– if we are legally obliged to do so,– if the disclosure is based on consent, or– if, in an individual case, we are pursuing legitimate interests in enforcing our claims and rights and your conflicting interests do not override them.For the operation and maintenance of our website and for the provision of the AI chat and the AI phone hotline, we use service providers that process personal data on our behalf (processors pursuant to Art. 28 GDPR). These include in particular:– hosting and infrastructure providers for the technical operation of this website,– voice, audio and AI service providers for processing voice, text and chat data (ElevenLabs for speech recognition, speech synthesis, conversation routing and AI-powered text processing in the chat widget),– telecommunications or VoIP providers for the technical provision of the phone hotline,– IT service providers for the maintenance, support and administration of our systems.We have concluded data processing agreements pursuant to Art. 28 GDPR with all processors, obliging them to process personal data only in accordance with our instructions and in compliance with high security standards.Zero-retention operation of voice and AI services
The voice and AI services we use are configured to operate in zero-retention mode. This means that conversation data is technically only processed for the duration of the respective request and is not stored permanently by the service provider as conversation logs or audio recordings. Details can be found in the documentation of the respective service provider.Data transfers to third countries
In connection with the use of the AI chat and the AI phone hotline, personal data (in particular conversation content, audio data, transcripts and technical connection data) is transmitted to and processed by our service provider Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA, as well as its affiliated companies and subcontractors.According to its privacy policy (https://elevenlabs.io/privacy-policy), ElevenLabs operates hosting and server locations in the United States, the Netherlands and Singapore, among others. Regardless of where the initial processing takes place, personal data may be stored in the United States. In addition, ElevenLabs uses cloud service providers (e.g. for infrastructure, storage, security) as its own processors.We have configured our AI-powered services (chat widget and AI hotline) to operate in ElevenLabs' zero-retention mode. According to ElevenLabs, this means that the content of requests and responses (including audio and transcripts) is only processed in volatile memory and is not stored permanently in ElevenLabs' systems as conversation logs or audio recordings. Certain metadata and account information (e.g. billing data, basic technical logs) may nevertheless be stored in accordance with the ElevenLabs privacy policy.Insofar as personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) in the course of using these services (in particular to the USA), we ensure that an adequate level of data protection within the meaning of Art. 44 et seq. GDPR is guaranteed for these transfers. This is done in particular through:– the use of standard contractual clauses of the EU Commission pursuant to Art. 46 GDPR and, where applicable, supplementary technical and organizational measures, and– where applicable, the use of other mechanisms recognized by the EU Commission (e.g. adequacy decisions or certifications under the EU-US Data Privacy Framework), insofar as these apply to the respective service provider.Nevertheless, it cannot be ruled out that authorities in third countries (in particular in the USA) may access the data processed by the service providers for control and surveillance purposes. We assess these risks on an ongoing basis and use ElevenLabs as a service provider with particular care, especially in view of its existing data protection and security measures (including SOC 2, a zero-retention option and data residency options).The use of our AI-powered services (chat widget and AI hotline) is voluntary. If you have concerns about data processing by ElevenLabs, you can also reach us through conventional channels (email, phone). In this case, no data is transferred to third-party providers outside the EU/EEA.Further information on the sub-processors used by ElevenLabs, the specific storage locations and the safeguards in place is available in the ElevenLabs privacy policy and, on request, from us.7. Your rights as a data subject
Within the scope of the statutory provisions, you have the following rights with regard to the personal data concerning you:– right of access (Art. 15 GDPR)– right to rectification (Art. 16 GDPR)– right to erasure (Art. 17 GDPR)– right to restriction of processing (Art. 18 GDPR)– right to data portability (Art. 20 GDPR)– right to object to certain processing (Art. 21 GDPR)Where processing is based on your consent, you have the right to withdraw this consent at any time with effect for the future (Art. 7(3) GDPR).To exercise your rights, you can contact us at any time:Email: info@wunderwerkstatt.xyzPhone: 02903 5599808
8. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data if you believe that the processing infringes the GDPR.The competent authority for North Rhine-Westphalia is in particular:Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW – State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)Postfach 20 04 4440102 DüsseldorfWeb: https://www.ldi.nrw.de/