Privacy policy

We process as little personal data as possible – and only where we need it.

As of 24 October 2026. This is a translation for your convenience; the German version is authoritative.

Controller

Wiestigo UG (haftungsbeschränkt)
Finkenwerder Landscheideweg 91
21129 Hamburg
Phone: +49 15511 557326
Email: support@wiestigo.com (for data protection matters)

Further details are in the legal notice.

We have not appointed a data protection officer, as we are not required to (Art. 37 GDPR, Section 38 of the German Federal Data Protection Act). We answer questions about data protection at the email address above.

In brief

• This site sets no cookies. In your browser’s storage it keeps only your answer about consent.
• We count visits only if you agree – and only as totals, without keeping your IP address.
• It loads nothing from other providers: fonts, scripts and images come exclusively from our own server.
• It is operated in the European Union.
• It is aimed at businesses, not at children.
• Beyond what is technically needed to deliver the site, we only collect personal data when you write to us via the form or by email, or call us.

Providing the site

The site runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in the European Union. We have a data processing agreement with them pursuant to Art. 28 GDPR. The site is delivered over encrypted connections (HTTPS) only.

With every request the server processes:

• the date and time of the request,
• the address requested,
• whether the request succeeded (status code) and the amount of data transferred,
• the page you came from,
• details of your browser and operating system,
• your IP address.

This is necessary to deliver the site to you, to find errors and to detect and fend off attacks. That is our legitimate interest; the legal basis is Art. 6(1)(f) GDPR. Without these details the site cannot be delivered.

The server’s access log only records your IP address in shortened form – without the last block for IPv4, with only the first three blocks for IPv6 – so that, as a rule, it can no longer be attributed to a person. Only if a technical error occurs while delivering a page may the full IP address appear in the error log. Entries in both logs are deleted after seven days at the latest. The exception is entries we need to investigate an attack: we keep them until the attack has been cleared up and pass them on to law enforcement authorities if necessary (Art. 6(1)(f) GDPR).

Your consent

On your first visit we ask whether we may count how the site is used. “Accept” and “Decline” carry equal weight; without an answer we count nothing. We keep your answer with its date in your browser’s storage (localStorage, key wiestigo.einwilligung) so that we do not ask again on every page. It never leaves your browser. Storing it is strictly necessary for this (§ 25(2) no. 2 TDDDG). The entry remains until you change it, clear your browser data or the purpose changes – then we ask again. Your answer applies only to this browser on this device.

Via “Change consent” at the bottom of every page you can change or withdraw your answer at any time; withdrawal applies from then on. If your browser sends the Global Privacy Control signal, we do not ask and do not count. Without JavaScript nothing is counted.

Visitor measurement

If you have agreed, your browser reports to our server on every page view: the page viewed (without any additions to the address), the language of the page, the domain of the page you came from (such as google.com – never the full address), and whether your window is as wide as a phone, a tablet or a desktop. If you came via a link with a tag – from a post or a flyer, for example – your browser also reports that tag: a short code such as linkedin ormesse from a fixed list, carried in the address as ?q=; it says nothing about you as a person and is counted as a total together with the page view. Our server uses this to increase counters per day and forgets the report. Only these totals are stored; no IP address, no time of day, no cookie, no identifier that recognises you. No path through the site can be read from them. Reports that identify themselves as machines, and unusually many reports from one connection, are discarded; for this limit the IP address is counted only as a checksum in memory for at most one hour, as for the form.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We keep the totals for two years. The reports do not go into any access log.

Independently of this, we count how many requests arrive via the form each day – as a number, without any details from the request (Art. 6(1)(f) GDPR; our legitimate interest is knowing whether the site fulfils its purpose).

Requests via the form

When you request a demo, we process your name, business email address, company, preferred date (if you give one), your message (if you write one), the language of the page and the time of the request. We use these details to answer your request and to prepare the demo (Art. 6(1)(b) GDPR). You are neither legally nor contractually obliged to provide these details; without your name, email address and company, however, we cannot answer your request.

Your request is stored on our server only until it has been delivered as an email to our mailbox; if delivery fails, only for as long as we keep trying to deliver it. The mailbox is operated byHeinlein Hosting GmbH (mailbox.org), Schwedter Straße 8/9A, 10119 Berlin, Germany, with whom we also have a data processing agreement. How long we keep your request there is set out under How long we keep data.

We protect the form against automated requests without a picture puzzle: with a field that is invisible to people, with a timestamp that contains no personal data, and with a limit on the number of requests per connection. For this limit, the IP address is counted in the server’s memory in an unrecognisable form (as a checksum with a random value that changes on every start) for at most one hour and is never stored (Art. 6(1)(f) GDPR).

Contact by email or phone

If you email or call us, we process the details you give us – for a call, also your phone number if it is transmitted – to answer your enquiry. Where it concerns a contract or steps towards one, the legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR (our legitimate interest is answering enquiries). We do not record calls; notes on a call are treated like an email. How long we keep the details is set out under How long we keep data.

How long we keep data

We keep personal data for as long as we need it for the respective purpose – to answer your enquiry, prepare a demo, or conclude and perform a contract with you, for example – or for as long as we have a legitimate interest in keeping it, for example to assert or defend claims arising from a contract until they become time-barred (Art. 6(1)(f) GDPR). We then delete it unless statutory obligations require us to keep it: tax and commercial retention periods oblige us to keep contracts, invoices and business letters, for example, for a number of years (Section 257 of the German Commercial Code, Section 147 of the German Fiscal Code; Art. 6(1)(c) GDPR).

Where a processing operation has a period of its own – the server logs or the totals of visitor measurement, for example – it is stated in its section.

Recipients and transfers to third countries

We pass on personal data only where this is necessary for the purposes described. Recipients are:

• Hetzner Online GmbH – they operate the server of this site (data processing),
• Heinlein Hosting GmbH (mailbox.org) – they operate our mailbox (data processing),
• authorities and other bodies where we are legally obliged to disclose data, such as tax authorities,
• other service providers who support us in our work – for example for video conferences (such as during a demo), scheduling, accounting or storing documents. They receive only the data they need for their task and process it on our behalf and on our instructions (Art. 28 GDPR),
• tax advisers and lawyers, who are bound to confidentiality, where needed for a business relationship or to assert or defend legal claims.

We do not sell data. Our server and mailbox are located in the European Union. If a service provider is based outside the European Union and the European Economic Area, or processes data there, we transfer data only under the conditions of Art. 44 et seq. GDPR – for example on the basis of an adequacy decision of the European Commission (for the USA: for companies certified under the EU-US Data Privacy Framework) or of the European Commission’s standard contractual clauses. You can obtain a copy of these safeguards on request.

Links to other websites

In some places the site links to other websites, for example for image credits or standards. Only when you follow a link does the other provider receive your IP address and learn that you come from our domain – not from which page. What it does with this is its responsibility; its privacy notice applies.

Your rights

You have the right

• to obtain information about the data we process about you (Art. 15 GDPR),
• to have incorrect data corrected and incomplete data completed (Art. 16 GDPR),
• to have your data erased (Art. 17 GDPR),
• to have processing restricted (Art. 18 GDPR),
• to receive data that we process by automated means on the basis of your consent or a contract in a common, machine-readable format, or to have it transmitted to someone else (Art. 20 GDPR) – this does not apply to the data used to provide the site, as it is based on our legitimate interest,
• to object to processing (Art. 21 GDPR; see Your right to object), and
• to withdraw consent at any time (Art. 7(3) GDPR); the withdrawal applies from then on, and processing until then remains lawful.

To do so, write to support@wiestigo.com. So that we do not hand your data to anyone else, we may ask who you are if in doubt. If you believe that we process your data unlawfully, you may also lodge a complaint with a data protection supervisory authority of your choice (Art. 77 GDPR), for example the one responsible for us: the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

Your right to object

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. The data used to provide the site and the logs are strictly necessary for its operation.

Where we process your data to send you advertising, you may object at any time without giving reasons (Art. 21(2) GDPR). We will then no longer use it for that purpose.

An informal objection to support@wiestigo.com is sufficient.

No automated decisions

We make no decisions based solely on automated processing and create no profiles.

Changes

If what this site does changes, or a new way of reaching us is added, we change this policy before the change takes effect. The version published here applies.