1. Controller and data protection officer

The controller within the meaning of Art. 4(7) GDPR is:

You can reach our external data protection officer at:

2. Types of data, purposes and data subjects

Types of data: usage data (access times, pages visited), master data (name, address, company), contact data (telephone number, email address), payment data (bank details, payment history), contract data (services booked, term), communication data (IP address), sign-in data (sign-in identifier, sign-in verifier).

Purposes: provision of the website and the cloud services; contract performance and billing; customer service and support; security and uninterrupted operation; preservation of evidence; compliance with statutory retention obligations; handling of enquiries and applications; information about our services.

Data subjects: website visitors, customers and their users, prospective customers, suppliers, applicants.

3. Legal bases

• Consent: Art. 6(1)(a) GDPR
• Contract and pre-contractual measures: Art. 6(1)(b) GDPR
• Legal obligation, such as retention obligations: Art. 6(1)(c) GDPR
• Vital interests: Art. 6(1)(d) GDPR
• Legitimate interests: Art. 6(1)(f) GDPR, unless your interests, fundamental rights and freedoms override them

4. Provision of the website and server log files

When you use our website for information only, we collect the data your browser transmits to our server: IP address, date and time of access, page requested, access status (HTTP status code), amount of data transferred, referring website, browser type and version, operating system, language. This data is not combined with other personal data.

The purpose is the secure and functional delivery of the website. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We store the log files for 70 days; they are then deleted unless we need them as evidence of attacks on the infrastructure or other violations of law.

The website runs on our own systems in Germany. Fonts and icons are served from our own servers; no third-party services are loaded.

5. Cookies

We only set one technically necessary cookie that stores your language choice and, in the customer area, the cookies required for sign-in. The legal basis is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR in the customer area. We do not use cookies for analytics, reach measurement or advertising. You can delete or block cookies in your browser settings; some functions may then not be available.

6. Protection of forms against abuse

To protect our forms against automated submissions we use mCaptcha, which we operate ourselves. Your browser solves a computational task; no data is transmitted to third parties. The legal basis is our legitimate interest in preventing spam and abuse under Art. 6(1)(f) GDPR.

7. Contact by form, email or post

When you contact us, we process your details to handle the enquiry and may store them in our customer management system. The legal basis is Art. 6(1)(f) GDPR (answering enquiries), additionally Art. 6(1)(b) GDPR for enquiries aimed at concluding a contract, and Art. 6(1)(a) GDPR where you have given consent.

We delete the data once the enquiry has been resolved. We keep enquiries from customers until two years after the end of the contract. Where statutory retention obligations apply, we delete the data when they expire (section 10).

8. Contact by telephone

If you call us, your telephone number is processed to handle the call and is displayed and stored in the telephone system so that we can call you back and document the call. The legal basis is Art. 6(1)(f) GDPR, additionally Art. 6(1)(b) GDPR where the call concerns a contract. The call list is overwritten after 90 days. We block numbers of unsolicited advertising calls and review the block annually. You can call with a withheld number.

9. Applications

We process applications to conduct the application procedure. The legal basis is Art. 6(1)(b) GDPR. Please do not send special categories of personal data under Art. 9 GDPR, such as photos that reveal ethnic origin or religion; you may voluntarily disclose a severe disability. If no employment relationship results, we delete the documents six months after the rejection in order to defend claims under the German General Equal Treatment Act (AGG).

10. Storage period and statutory retention

Unless stated otherwise in this policy, we delete or block data as soon as the purpose ceases to apply or you withdraw consent, unless a statutory retention obligation or an evidentiary purpose prevents this. Statutory periods include: commercial and business letters 6 years, accounting vouchers including invoices 8 years, books of account and annual financial statements 10 years (Section 257 HGB, Section 147 AO).

11. Social media

We maintain profiles on LinkedIn and X. When you visit them, the privacy notices of the respective network apply; operators generally also process your data for advertising and market research. We process data you share with us there to communicate with you; the legal basis is Art. 6(1)(f) GDPR. For page statistics we are jointly responsible with the operator (Art. 26 GDPR) where the network provides for this. You can exercise your data subject rights most effectively directly with the operator. Where operators transfer data to the USA, they rely on the EU-US Data Privacy Framework or on standard contractual clauses.

• LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – https://www.linkedin.com/legal/privacy-policy
• X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland – https://x.com/en/privacy

12. Your WX-ONE customer account

When you create a customer account, we process details about your company and the persons acting for it (such as name, address and email address) as well as the access data. The legal basis is Art. 6(1)(b) GDPR. This also applies to users that a customer creates or invites; we process their account and sign-in data as controller as well.

We never receive your password. It is derived in your browser; only a verifier derived from it, which we hash again, is transmitted to and stored by us.

WX-ONE currently operates the regions Germany and India. We store details about your company and persons as well as payment and bank data in the region of the country in which your company is registered – for companies based in Germany exclusively in Germany.

So that you can still sign in if a region fails, we synchronise a small amount of data to all regions: your sign-in identifier, the sign-in verifier, your permissions and your SSH keys without their comment field. Outside your home region the sign-in identifier is held only in hashed form, not as a readable email address. Name, address and payment and bank data are not synchronised. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in a resilient service under Art. 6(1)(f) GDPR.

We keep the account data for as long as your account exists. After the end of the contract we delete it as soon as it is no longer required and no further claims can be asserted under the contract; statutory retention obligations (section 10) remain unaffected.

13. Contract performance and billing

We process master, contract, usage and payment data to perform the contract under Art. 6(1)(b) GDPR and to comply with legal obligations under Art. 6(1)(c) GDPR. Data is only passed on to third parties where this is necessary to perform the contract, for example to payment service providers, or to enforce claims, or where we are legally obliged to do so.

We may send technical information and information about our own similar services to the email address you have provided. You can object to this at any time without incurring costs other than the transmission costs at basic rates (Section 7(3) UWG).

14. Support

We handle support requests in a ticket system we operate ourselves. The legal basis is Art. 6(1)(b) GDPR. Outside German business hours and on demand we are supported by our affiliated company WIZARDTALES PRIVATE LIMITED in India; for the transfer see section 18.

15. Operation and security of the platform

To operate securely we log access to the platform and the customer interfaces, in particular IP addresses, times, actions and errors. The legal basis is our legitimate interest in security and traceability under Art. 6(1)(f) GDPR and Art. 32 GDPR. We keep security-relevant logs for at least one year so that attacks can also be detected and investigated afterwards.

To protect against DDoS attacks, traffic to our public endpoints passes through filtering systems of a specialised service provider in data centres in Germany. IP addresses and traffic data are processed; no transfer to third countries takes place.

16. Data you store in our services

You are the controller for content that you store or process in our cloud services; we process it on your behalf under the data processing agreement. The subprocessors we use are listed at wx1.de/en/subprocessors.

17. Disclosure to third parties and processors

We do not disclose data to third parties without a legal basis. Disclosure may occur, for example, to perform a contract, on the basis of a court order or a legal obligation. We only use processors on the basis of a contract under Art. 28 GDPR; we select them carefully and monitor them. Our affiliated company WIZARDTALES PRIVATE LIMITED in India acts as our processor (sections 12, 14 and 18).

18. Transfers to third countries

We only transfer personal data to India, to our affiliated company WIZARDTALES PRIVATE LIMITED: the synchronised sign-in data referred to in section 12 to the India region, and in the context of support under section 14. There is no adequacy decision of the European Commission for India. The transfers are based on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). You can obtain a copy on request using the contact details in section 1.

We do not ourselves transfer any personal data to the USA. For transfers by social network operators see section 11.

19. Your rights

• Access to your data processed by us (Art. 15 GDPR)
• Rectification of inaccurate or completion of incomplete data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless a retention obligation applies
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Objection (Art. 21 GDPR): where processing is based on our legitimate interest, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.
• Complaint to a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

To exercise your rights, a message to the contact details in section 1 is sufficient.

20. Automated decision-making

No automated decision-making, including profiling, under Art. 22 GDPR takes place.