Privacy Policy

Introduction

With this Privacy Policy, we would like to inform you about the types of personal data we process, the purposes for which we process it, and the extent of such processing.

This Privacy Policy applies to all processing of personal data carried out by us, including in connection with the provision of our services, on our websites, within mobile applications, and on external online platforms such as our social media profiles (collectively referred to as the “Online Services”).

Last updated: August 1, 2022

Data Controller

Wave In Motion GmbH
Agrippinawerft 14
50678 Cologne
Germany

Managing Director / Authorized Representative
Theodora Shandé

Email:
kontakt@wave-in-motion.de

Overview of Data Processing

We may process the following categories of personal data:

Categories of Data Subjects

We may process personal data relating to:

Customers
Employees
Prospective customers
Communication partners
Website users
Job applicants
Contest and giveaway participants
Business and contractual partners
Event participants

Purposes of Processing

We process personal data for the following purposes:

Providing contractual services and customer support
Responding to inquiries and communication requests
Implementing security measures
Direct marketing
Audience measurement and analytics
Tracking and optimization
Administrative and organizational processes
Conversion tracking
Audience targeting and segmentation
Managing and responding to requests
Recruitment and hiring processes
Conducting contests and giveaways
Collecting feedback
Marketing activities
Creating user-related profiles
Improving the usability and functionality of our Online Services
Maintaining our IT infrastructure

Legal Bases for Processing

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and applicable national data protection laws.

Depending on the circumstances, processing is based on one or more of the following legal grounds:

Consent (Art. 6(1)(a) GDPR)

Where you have given us your consent for one or more specific purposes.

Contract Performance and Pre-Contractual Measures (Art. 6(1)(b) GDPR)

Where processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract.

Legal Obligation (Art. 6(1)(c) GDPR)

Where processing is necessary for compliance with a legal obligation to which we are subject.

Legitimate Interests (Art. 6(1)(f) GDPR)

Where processing is necessary for the purposes of our legitimate interests or those of a third party, provided such interests are not overridden by your rights and freedoms.

In addition to the GDPR, national data protection laws may apply, particularly the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, as well as the likelihood and severity of risks to individuals.

These measures include, among others:

Access controls
Data confidentiality safeguards
Integrity and availability protection
Backup and recovery procedures
Data minimization principles
Privacy-by-design and privacy-by-default measures

SSL/TLS Encryption

To protect data transmitted through our Online Services, we use SSL/TLS encryption. Secure connections can be identified by the “https://” prefix in your browser’s address bar.

Transfer of Personal Data

As part of our business activities, personal data may be disclosed or transferred to third parties, service providers, affiliated companies, contractors, or other recipients where necessary.

Recipients may include:

IT service providers
Hosting providers
Communication service providers
Professional advisors
Payment processors
Government authorities where legally required

Where personal data is shared, we ensure appropriate safeguards and contractual protections are in place.

Transfers Within Our Corporate Structure

Personal data may be shared with affiliated companies or internal departments where necessary for administrative purposes, contractual performance, legal compliance, or based on your consent.

International Data Transfers

Where personal data is processed outside the European Union (EU) or European Economic Area (EEA), we ensure compliance with applicable data protection laws.

Transfers to third countries take place only where:

An adequacy decision exists;
Standard Contractual Clauses (SCCs) have been implemented;
Appropriate safeguards are in place; or
The transfer is otherwise permitted under Articles 44–49 GDPR.

Data Retention and Deletion

Personal data is deleted when it is no longer required for the purposes for which it was collected, unless statutory retention obligations apply.

Where deletion is not possible due to legal requirements, processing will be restricted and the data will be retained only for the legally required period.

Retention periods may result from:

Commercial law requirements
Tax regulations
Legal claims and dispute resolution requirements
Contractual obligations

Cookies and Similar Technologies

Cookies are small text files or similar technologies stored on your device that allow information to be stored and retrieved.

Cookies may be used for:

Ensuring website functionality
Improving user experience
Security purposes
Analytics and performance measurement
Marketing and advertising

Consent

Where required by law, we obtain your consent before storing or accessing information on your device.

Consent can be withdrawn at any time with future effect.

Legal Basis

Depending on the purpose, cookies are processed on the basis of:

Your consent (Art. 6(1)(a) GDPR), or
Our legitimate interests (Art. 6(1)(f) GDPR)

Types of Cookies

Session Cookies

Session cookies are deleted automatically when you close your browser.

Persistent Cookies

Persistent cookies remain stored on your device after your browser has been closed and may remain active for up to two years unless deleted earlier.

Managing Cookies

You can manage or disable cookies through your browser settings.

You may also opt out of certain advertising cookies through:

Cookie Consent Management

We use a consent management platform to record and manage cookie preferences.

Borlabs Cookie

We use Borlabs Cookie for consent management. The service is hosted locally on our own servers and no data is transferred to third parties.

Further information:
https://de.borlabs.io/borlabs-cookie/

Business Services

We process personal data relating to our customers, prospective customers, business partners, and contractual partners (“Business Partners”) in connection with contractual relationships, pre-contractual inquiries, and related communications.

The processing is carried out to:

Fulfill contractual obligations;
Deliver agreed services;
Manage customer relationships;
Respond to inquiries;
Protect our legal interests;
Comply with legal and regulatory requirements;
Ensure efficient business operations.

Where necessary, personal data may be shared with service providers, subcontractors, tax advisors, legal advisors, payment providers, banks, or public authorities.

Personal data is retained only for as long as necessary to fulfill contractual, legal, or regulatory obligations.

Categories of Data Processed

Identification and contact information
Contractual information
Billing and payment information
Communication records

Legal Basis

Art. 6(1)(b) GDPR – Contract performance
Art. 6(1)(c) GDPR – Legal obligation
Art. 6(1)(f) GDPR – Legitimate interests

Third-Party Service Providers

To support our business operations, we use selected third-party providers and software solutions.

These services may process personal data where necessary to provide their functionality.

Accounting and Financial Services

DATEV eG
Accounting software, communication with tax advisors and authorities, document management.

FastBill GmbH
Accounting and invoicing software.

Hosting and Email Services

Millennials Digitaldesign GmbH & Co. KG
Website hosting and email services.

Personal data is processed only to the extent required for the operation and maintenance of our business processes.

Website Hosting and Provision of Online Services

To provide our website and online services, we process technical information that is necessary to deliver content and functionality to your device.

This may include:

IP address
Browser type and version
Device information
Operating system
Date and time of access
Referrer URLs
Usage and interaction data

Server Log Files

When you access our website, certain information is automatically recorded in server log files.

Server log files may contain:

Access date and time
IP address
Browser information
Operating system information
Referring website
Requested pages and files

This data is used to:

Maintain website security
Detect and prevent misuse
Ensure system stability
Diagnose technical issues

Server log data is generally deleted or anonymized after a maximum of 30 days unless longer retention is required for evidentiary purposes.

Hosting Provider

STRATO AG
Pascalstraße 10
10587 Berlin
Germany

For further information, please refer to STRATO’s Privacy Policy:
https://www.strato.de/datenschutz

Blogs and Publications

Where our Online Services include blogs, articles, or other publication features, personal data may be processed to facilitate communication and interaction between authors and readers.

Users who leave comments or submit content may have their IP address stored to protect against misuse, spam, unlawful content, or security incidents.

Comments and user-generated content may remain publicly visible unless removal is requested or legally required.

Legal Basis

Art. 6(1)(f) GDPR – Legitimate interests

Contact Requests and Communication

When you contact us via:

Contact forms
Email
Telephone
Social media channels
Other communication methods

we process the information you provide to handle your request and maintain our business relationship with you.

Depending on the nature of your request, the following information may be processed:

Name
Email address
Telephone number
Company details
Message contents
Technical communication data

Legal Basis

Art. 6(1)(b) GDPR – Pre-contractual and contractual communication
Art. 6(1)(f) GDPR – Legitimate interests

Messaging Services

We may communicate with users and business partners through messaging platforms and instant messaging services.

Please note that while many messaging platforms offer end-to-end encryption, providers may still process metadata such as:

Time of communication
Device information
Technical connection details
Approximate location data (depending on device settings)

Users may contact us through alternative communication channels such as email or telephone at any time.

Legal Basis

Art. 6(1)(a) GDPR – Consent
Art. 6(1)(b) GDPR – Contractual communication
Art. 6(1)(f) GDPR – Legitimate interests

Messaging Providers We May Use

Instagram Direct Messaging
Microsoft Teams
Telegram
WhatsApp

Please refer to the respective privacy policies of these providers for further information regarding their processing activities.

Video Conferences, Online Meetings and Webinars

We use third-party conferencing platforms to conduct:

Video conferences
Audio conferences
Online meetings
Webinars
Screen sharing sessions

Participation in online meetings may require the processing of:

Name and contact information
Profile information
Meeting credentials
IP address
Device and browser information
Audio and video content
Chat messages and uploaded files

Meeting recordings are only created where appropriate notice has been provided and, where required, consent has been obtained.

Participants are encouraged to review the privacy settings offered by the respective conferencing platform.

Legal Basis

Art. 6(1)(a) GDPR – Consent
Art. 6(1)(b) GDPR – Contract performance
Art. 6(1)(f) GDPR – Legitimate interests

Conference Platforms We May Use

Microsoft Teams
Zoom
Skype
Slack
Discord

Each provider processes data in accordance with its own privacy policies and, where applicable, Standard Contractual Clauses (SCCs) for international data transfers.

Recruitment and Job Applications

If you apply for a position with us, we process the personal data you provide as part of the recruitment process.

This may include:

Name and contact information
Curriculum vitae (CV)
Cover letter
Certificates and qualifications
References
Employment history
Any additional information voluntarily submitted

Applications may be submitted through online forms, email, recruitment platforms, or other communication channels.

Purpose of Processing

We process applicant data to:

Assess qualifications and suitability
Conduct recruitment and selection procedures
Communicate with applicants
Establish potential employment relationships

Special Categories of Personal Data

Where applicants voluntarily provide special categories of personal data (e.g., health information, disability status, or diversity-related information), such data will only be processed where permitted by applicable law or based on explicit consent.

Retention Period

If an application is unsuccessful, applicant data will generally be deleted no later than six months after completion of the recruitment process, unless legal obligations or legitimate interests require longer retention.

Where applicants consent to inclusion in a talent pool, data may be retained for future recruitment opportunities until consent is withdrawn.

Recruitment Services

We may use third-party recruitment platforms and recruitment management services, including:

LinkedIn Recruiter
Recruitment software and applicant tracking systems

Legal Basis

Art. 6(1)(b) GDPR – Pre-contractual measures
Art. 6(1)(f) GDPR – Legitimate interests
Art. 9(2)(a) GDPR – Explicit consent (where applicable)

Cloud Services

To support our business operations, we use cloud-based software solutions and storage services.

These services may be used for:

Document storage and collaboration
Project management
Communication
Calendar management
Email services
File sharing
Content creation and management

Depending on the service used, personal data may be stored or processed on servers operated by third-party providers.

Cloud Service Providers

We may use services provided by:

Adobe Creative Cloud
Apple iCloud
Dropbox
Google Cloud
Google Workspace
Microsoft Cloud Services

Where personal data is transferred outside the European Economic Area (EEA), appropriate safeguards such as Standard Contractual Clauses (SCCs) are implemented where required.

Legal Basis

Art. 6(1)(f) GDPR – Legitimate interests

and, where applicable,

Art. 6(1)(b) GDPR – Contract performance

Newsletters and Electronic Communications

We send newsletters and other electronic communications only where:

You have provided your consent; or
We are otherwise legally permitted to do so.

Our newsletters may contain information regarding:

Company news
Products and services
Industry insights
Promotions and special offers
Events and announcements

Subscription Process

Newsletter subscriptions generally require only an email address.

We use a double opt-in procedure to verify subscriptions. After registration, you will receive an email requesting confirmation of your subscription.

We record:

Subscription date and time
Confirmation date and time
IP address
Subscription status

to demonstrate compliance with applicable legal requirements.

Newsletter Analytics

Our newsletters may include tracking technologies such as web beacons to measure:

Open rates
Click-through rates
User engagement

These analytics help us improve the relevance and effectiveness of our communications.

Where required by law, such tracking is based on your consent.

Unsubscribing

You may unsubscribe from our newsletter at any time by:

Clicking the unsubscribe link included in every newsletter; or
Contacting us directly.

Following unsubscribing, we may retain limited information necessary to document your previous consent and prevent future unwanted communications.

Legal Basis

Art. 6(1)(a) GDPR – Consent

Marketing Communications

We may process personal data for marketing purposes through communication channels such as:

Email
Telephone
Postal mail
Other legally permitted communication methods

Recipients may withdraw consent or object to marketing communications at any time.

Following an objection or withdrawal of consent, we may retain limited suppression data to ensure compliance with your request and prevent future marketing communications.

Legal Basis

Art. 6(1)(a) GDPR – Consent
Art. 6(1)(f) GDPR – Legitimate interests

Contests, Giveaways and Promotional Campaigns

We may organize contests, giveaways, competitions, and promotional campaigns.

Personal data is processed only to the extent necessary for:

Administration of the campaign
Participant verification
Winner selection
Prize distribution
Fraud prevention

Depending on the campaign, the following information may be processed:

Name
Contact details
Submitted content
Technical participation data

Where winners are announced publicly, names may be published only to the extent permitted by applicable law or based on consent.

Participant data is generally deleted within six months after completion of the campaign unless longer retention is legally required.

Legal Basis

Art. 6(1)(b) GDPR – Contract performance

Surveys and Feedback

We may conduct surveys, questionnaires, and feedback programs to better understand user needs and improve our services.

Unless otherwise stated, survey results are evaluated in anonymized form.

To facilitate participation and prevent misuse, certain technical information may be processed, including:

IP addresses
Browser information
Device information
Participation timestamps

Purpose of Processing

Product and service improvement
Customer satisfaction measurement
Market research
User experience optimization

Legal Basis

Art. 6(1)(f) GDPR – Legitimate interests

Analytics, Marketing and Third-Party Content

Web Analytics and Performance Monitoring

We use analytics tools to better understand how visitors interact with our website and online services.

Analytics may help us evaluate:

Website traffic
Popular content and pages
User behavior and navigation paths
Technical performance
Conversion rates
User experience improvements

To achieve this, cookies and similar technologies may be used to collect information such as:

IP address (in pseudonymized form where possible)
Browser type and version
Device information
Operating system
Visited pages
Session duration
Referral sources
Interaction data

Where required by applicable law, analytics technologies are activated only after obtaining your consent.

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited.

Google Analytics helps us understand website usage patterns and improve our services.

Google may process data on servers located outside the European Economic Area. Where required, data transfers are protected through Standard Contractual Clauses (SCCs) and other appropriate safeguards.

You can learn more about Google’s privacy practices at:

https://policies.google.com/privacy

You may also opt out of Google Analytics through:

https://tools.google.com/dlpage/gaoptout

Legal Basis

Art. 6(1)(a) GDPR – Consent

Online Marketing and Advertising

We use online marketing technologies to promote our services and measure the effectiveness of advertising campaigns.

These technologies may involve:

Advertising cookies
Conversion tracking
Audience segmentation
Remarketing and retargeting
Campaign performance measurement

Marketing technologies may collect information such as:

Website visits
Content interactions
Advertising engagement
Device information
Browser information
General location information

The purpose of these technologies is to deliver more relevant advertising and improve our marketing effectiveness.

Advertising Platforms

We may use:

Google Ads

Used to display advertisements across Google’s advertising network and measure conversions.

Facebook Ads

Used to advertise our services on Facebook and measure campaign effectiveness.

Instagram Ads

Used to advertise our services on Instagram and measure campaign performance.

LinkedIn Insight Tag

Used to analyze campaign performance and improve professional audience targeting.

Legal Basis

Art. 6(1)(a) GDPR – Consent

Customer Reviews and Rating Services

We may participate in customer review and rating programs to evaluate and improve our services.

Where customers choose to submit reviews, personal data may be processed to:

Verify authenticity
Manage reviews
Display ratings and testimonials
Improve customer satisfaction

In certain cases, information such as:

Name
Email address
Order information
Service details

may be shared with a review provider solely for verification purposes.

Google Customer Reviews

We may use Google Customer Reviews to collect and display customer feedback.

For more information, please refer to:

https://policies.google.com/privacy

Legal Basis

Art. 6(1)(f) GDPR – Legitimate interests

Social Media Presence

We maintain profiles and business pages on various social media platforms in order to:

Communicate with customers and prospects
Share company news and content
Promote our services
Engage with our community

When you visit our social media profiles, the respective platform operators may process your personal data according to their own privacy policies.

This may include:

Usage data
Interaction data
Device information
Advertising identifiers
Profile information

Please note that social media providers may process personal data outside the European Union.

Social Media Platforms We Use

We may maintain profiles on:

Instagram
Facebook
LinkedIn
Pinterest
TikTok
X (formerly Twitter)
Vimeo
YouTube

For information about how these providers process personal data, please consult their respective privacy policies.

Legal Basis

Art. 6(1)(f) GDPR – Legitimate interests

Facebook Pages

Where we operate a Facebook Page, we may be considered jointly responsible with Meta Platforms Ireland Limited for certain data processing activities relating to page insights and visitor statistics.

Meta provides aggregated information regarding visitor interactions with our Facebook Page, allowing us to better understand audience engagement.

Further information is available at:

https://www.facebook.com/legal/terms/page_controller_addendum

Embedded Content and Third-Party Integrations

Our website may include content and functionality provided by third parties.

Examples include:

Videos
Maps
Social media feeds
Icons and fonts
Embedded posts
Interactive content

When such content is loaded, the third-party provider typically receives your IP address and certain technical information required to deliver the content.

Depending on the provider, additional technologies such as cookies, web beacons, or similar tracking mechanisms may be used.

Legal Basis

Art. 6(1)(f) GDPR – Legitimate interests

Google Maps

We may integrate Google Maps to display geographic information and locations.

When using Google Maps, Google may process:

IP address
Location information
Device information
Usage data

Google Maps is provided by Google Ireland Limited.

Privacy information:

https://policies.google.com/privacy

YouTube Videos

We may embed videos from YouTube.

Where possible, videos are embedded using YouTube’s enhanced privacy mode (“youtube-nocookie”), which reduces the amount of data collected before a video is played.

Nevertheless, YouTube may process technical information once a video is loaded or played.

Privacy information:

https://policies.google.com/privacy

Instagram and LinkedIn Integrations

Our website may include content or functionality provided by Instagram or LinkedIn.

Examples include:

Embedded posts
Share buttons
Social media widgets
Interactive content

When such integrations are used, the respective provider may receive technical information, including your IP address and information regarding your interaction with our website.

Privacy Policies:

Instagram:
https://privacycenter.instagram.com/

LinkedIn:
https://www.linkedin.com/legal/privacy-policy

Fonts and Visual Resources

To improve the visual presentation of our website, we may use externally provided fonts, icons, and visual resources.

Font Awesome

Font Awesome resources are hosted locally on our own servers. No personal data is transmitted to Font Awesome.

MyFonts

Where MyFonts is used, limited technical information may be processed to verify font licensing and usage statistics.

Privacy information:

https://www.myfonts.com/legal/website-use-privacy-policy/

Management, Productivity and Collaboration Tools

To support our internal operations and service delivery, we use selected third-party tools and platforms for communication, collaboration, project management, scheduling, and file sharing.

These services may process personal data where necessary to provide their functionality.

Examples include:

Project management tools
Scheduling and appointment booking services
Collaboration platforms
File transfer services
Productivity and workflow management software

Service providers we may use include:

Bitly
Doodle
Miro
Trello
WeTransfer

Personal data processed through these services is limited to what is necessary for the respective purpose and is handled in accordance with applicable data protection laws.

Legal Basis

Art. 6(1)(f) GDPR – Legitimate Interests

Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time to reflect changes in legal requirements, regulatory guidance, technological developments, or our data processing activities.

The latest version of this Privacy Policy will always be available on our website.

Where legally required, we will notify users of material changes and request any necessary consent.

Your Rights Under the GDPR

If you are located within the European Economic Area (EEA) or otherwise benefit from applicable data protection laws, you have the following rights regarding your personal data.

Right to Object

You have the right to object, on grounds relating to your particular situation, to the processing of personal data based on Article 6(1)(e) or Article 6(1)(f) GDPR.

Where personal data is processed for direct marketing purposes, you may object at any time to such processing.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time with future effect.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Right of Access

You have the right to obtain confirmation as to whether personal data concerning you is being processed and, where that is the case, access to:

The personal data concerned
Information about the processing activities
Recipients of the data
Retention periods
Your legal rights

You may also request a copy of your personal data.

Right to Rectification

You have the right to request correction of inaccurate personal data and completion of incomplete personal data.

Right to Erasure (“Right to be Forgotten”)

You have the right to request the deletion of your personal data where the legal requirements for such deletion are met.

Right to Restriction of Processing

You have the right to request restriction of processing under the conditions set out in Article 18 GDPR.

Right to Data Portability

You have the right to receive personal data that you have provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.

Right to Lodge a Complaint

If you believe that the processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with a competent supervisory authority.

You may do so in particular in:

Your country of residence;
Your place of work; or
The place where the alleged infringement occurred.

Definitions

For the purposes of this Privacy Policy, the following terms have the meanings assigned to them by applicable data protection laws, including the GDPR.

Personal Data

Any information relating to an identified or identifiable natural person.

An identifiable person is one who can be identified directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their identity.

Processing

Any operation or set of operations performed on personal data, whether by automated means or otherwise.

Examples include:

Collection
Recording
Organization
Storage
Adaptation
Retrieval
Consultation
Disclosure
Transmission
Restriction
Erasure

Controller

The natural or legal person that determines the purposes and means of processing personal data.

For the purposes of this Privacy Policy, the controller is:

Wave In Motion GmbH
Agrippinawerft 14
50678 Cologne
Germany

Email: kontakt@wave-in-motion.de

Profiling

Any form of automated processing of personal data used to evaluate certain personal aspects relating to an individual, including the analysis or prediction of preferences, interests, behavior, location, or other characteristics.

Tracking

The collection and analysis of user behavior across websites, applications, devices, or services, typically for analytics or marketing purposes.

Audience Measurement

The collection and evaluation of information regarding how users interact with online services in order to improve functionality, usability, and performance.