Privacy and Compliance
Privacy Policy.
This statement describes the processing of personal data when visiting this website and interacting with our services — contact form, initial consultation booking, newsletter. It complies with the requirements of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Last updated: May 20, 2026 · Version 1.0
Table of Contents
- 1Data Controller
- 2Data Protection Officer
- 3General Information on Data Processing
- 4Server Log Files
- 5Cookies
- 6Web Analytics with SimpleAnalytics
- 7Contact Form and Email Contact
- 8Newsletter
- 9Booking an initial consultation via Simply Schedule Appointments
- 10Video calls via mailbox.org Meet
- 11Hosting
- 12SSL/TLS Encryption
- 13Data Transfer to Third Countries
- 14Rights of the data subject
- 15Current status and changes
§ 1
Controller
The controller within the meaning of the and other national data protection laws as well as other data protection regulations is:
waveImpact GmbHDr. Valentin José Mayr (Managing Director)
Fitgerstr. 7
28209 Bremen
Germany
Email: datenschutz@waveimpact.de
Web: waveimpact.de
§ 2
Data Protection Officer
Due to the size of our company, we are not legally required to appoint a Data Protection Officer. Please direct inquiries regarding data protection and the exercise of your rights directly to datenschutz@waveimpact.de. We will generally respond within ten business days.
§ 3
General Information on Data Processing
We generally process our users’ personal data only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data generally takes place only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.
Possible legal bases are:
- Art. 6(1)(a) GDPR — Consent (e.g., newsletter)
- Art. 6(1)(b) GDPR — Contract or pre-contractual measures (e.g., initial consultation, consultation offer)
- Art. 6(1)(c) GDPR — Legal obligation (e.g., retention requirements)
- Art. 6(1)(f) GDPR — Legitimate interest (e.g., technical website operation)
Personal data is deleted as soon as the purpose of the processing no longer applies — provided that no statutory retention obligations preclude this.
§ 4
Server Log Files
We host our website with Raidboxes GmbH (Hafenstr. 47–59, 48153 Münster, Germany). The provider is Raidboxes GmbH. When you visit our website, Raidboxes processes various (including) personal data about you. This includes:
- IP address (anonymized after seven days)
- Date and time of access
- Name of the page accessed
- Referrer URL (referring page)
- Browser and operating system used
- Browser language setting
Retention period: 7 days, followed by automatic anonymization and aggregation.
We have entered into a data processing agreement (DPA) with Raidboxes GmbH in accordance with Art. 28 GDPR. This agreement ensures that Raidboxes processes your personal data exclusively in accordance with our instructions and in compliance with data protection regulations. Further information on data protection can be found in Raidboxes’ privacy policy.
§ 5
Cookies
This website uses only technically necessary cookies that are required for the operation of the website (e.g., for session management). We do not use any tracking, marketing, or profiling cookies. Consent to the use of cookies is therefore not required; a cookie banner is intentionally not displayed.
§ 6
Web Analytics with SimpleAnalytics
We use SimpleAnalytics (provider: Simple Analytics B.V., Amsterdam, Netherlands) for the anonymous analysis of the use of our website. SimpleAnalytics is a cookie-free, privacy-friendly analytics solution that does not collect personal data and does not set tracking cookies.
Only aggregated, anonymous data is collected:
- Number of visits per page
- Aggregated time spent on site
- Region of origin (country, not city)
- Referring website (if available)
- Browser type and device class (desktop / mobile)
Individual users are not identified. The data remains within the EU (server location: Netherlands). Further information at simpleanalytics.com/privacy.
Data Processing Agreement: Not required, as no cookies are used and no personal data is collected.
§ 7
Contact Form and Email Contact
If you contact us via the contact form or by email at info@waveimpact.de , your information (name, company, email address, phone number (if applicable), type of inquiry, company size, your message) will be processed and stored solely for the purpose of responding to your inquiry .
Contact Form Data
If you wish to use the contact form provided on the website to get in touch with us, we require the data requested in the form to respond to your inquiry. Some data is collected on a voluntary basis only. We use this data exclusively to process your inquiry and do not share it with third parties.
The processing of data entered into the contact form is based solely on your consent (Art. 6(1)(a) GDPR). You may revoke your consent to the storage of this data at any time. The lawfulness of data processing operations that have already taken place remains unaffected by the revocation.
The data you provide to contact us will be stored by us until you request its deletion or until statutory deadlines permit or require us to delete it.
CentralStationCRM
This website uses the CRM software CentralStationCRM to store and process your contact information. The provider is 42he GmbH, Herderstraße 70, 50931 Cologne, Germany.
CentralStationCRM is a service that can be used, among other things, to organize and manage customers. The data you enter for the purpose of contacting us is stored on CentralStationCRM’s servers in Germany.
If you do not want further processing by CentralStationCRM, you must inform the operator of this website of this after you have contacted us.
Data analysis by CentralStationCRM
With the help of CentralStationCRM, we are able to better organize inquiries received via our website and respond to them more quickly. CentralStationCRM also enables us to better group our customers and contacts. This allows us to work more effectively in sales and marketing.
Legal Basis
Data processing is based on your consent (Art. 6(1)(a) GDPR). You may withdraw this consent at any time. The lawfulness of data processing operations that have already taken place remains unaffected by the withdrawal.
Retention Period
The data you have provided to us for the purpose of contacting us will be stored by us until we delete it.
For more details, please refer to CentralStationCRM’s privacy policy at: https://centralstationcrm.net/www/privacy
Conclusion of a Contract for Data Processing on Behalf of a Third Party
We have entered into a contract with CentralStationCRM in which we oblige CentralStationCRM to protect our customers’ data and not to disclose it to third parties. This contract can be viewed at the following link:
https://centralstationcrm.de/avv
Analytics Tools and Advertising
Google reCAPTCHA
We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our websites. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
reCAPTCHA is used to verify whether data entry on our websites (e.g., in a contact form) is performed by a human or by an automated program.
To do this, reCAPTCHA analyzes the website visitor’s behavior based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website.
For the analysis, reCAPTCHA evaluates various pieces of information (e.g., IP address, the duration of the website visitor’s stay on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Google.
The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place.
Data processing is based on Art. 6(1)(f) of the GDPR. The website operator has a legitimate interest in protecting its web offerings from abusive automated spying and from SPAM.
For more information about Google reCAPTCHA and Google’s privacy policy, please visit the following links:
https://www.google.com/intl/de/policies/privacy/
and
https://www.google.com/recaptcha/intro/android.html.
§ 8
Newsletter
If you subscribe to our newsletter, we process your email address for the purpose of sending the newsletter. Registration takes place via a double opt-in procedure: After registration, you will receive a confirmation email in which you must confirm your registration. Only after this confirmation will your data be used for sending the newsletter.
The newsletter is sent via mailbox.org (provider: Heinlein Hosting GmbH, Berlin), a German, GDPR-compliant email provider. Your data will not be transferred to third parties outside the EU . A data processing agreement has been established in accordance with Art. 28 GDPR.
You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in every newsletter email or sending an informal email to datenschutz@waveimpact.de . After you unsubscribe, your email address will be removed from the mailing list.
Retention period: Until consent is withdrawn.
§ 9
Online Appointment Booking with Simply Schedule Appointments
To schedule non-binding consultation appointments, we use the Simply Schedule Appointments (SSA) plugin, which runs as a self-hosted WordPress plugin on the same server as this website. When booking, we collect the following personal data:
- Name and email address
- Selected appointment (date, time, time zone)
- Phone number for follow-up inquiries
- Optional pre-meeting questions filled out by you
Purpose of processing: Scheduling, confirming, and conducting the requested appointment.
Legal basis: Art. 6(1)(b) GDPR (measures to initiate a contract at your request) and, where applicable, Art. 6(1)(f) GDPR (legitimate interest in efficient appointment organization).
Storage location: The data is stored exclusively on the servers of our German hosting provider (Raidboxes GmbH, Münster). No transfer to third parties or to third countries takes place.
Retention period: Booking data is retained after the appointment has taken place for the duration of any business initiation and is deleted no later than 12 months, provided no statutory retention requirements apply.
Withdrawal: You may object to processing at any time by contacting info@waveimpact.de or datenschutz@waveimpact.de.
§ 10
Video calls via mailbox.org Meet
For video calls as part of initial consultations or consulting engagements, we use mailbox.org Meet, a video conferencing application based on the open-source solution Jitsi (provider: Heinlein Hosting GmbH, Berlin). The servers are located in Germany.
Only session metadata is processed (start, end, participant identifiers). The content of the conversations is not automatically recorded. Recording takes place exclusively with the express consent of all participants and is not the norm.
§ 11
HostingThe hosting services underlying this site are provided by Raidboxes GmbH (Hafenstrasse 32, 48153 Münster, Germany). Raidboxes GmbH offers Software as a Service (SaaS) within the framework of cloud hosting.
Raidboxes GmbH automatically collects and stores server log files containing information that your browser transmits to us. This includes:
- Browser type
- Operating system
- Referrer URL (previously visited page)
- Hostname (IP address)
Raidboxes GmbH cannot associate this data with specific individuals. This data is not merged with other data sources. The data is deleted after statistical analysis, at the latest after 7 days. Further information can be found in the privacy policy of Raidboxes GmbH. This can be viewed here
We have also entered into a data processing agreement (DPA). This agreement governs the scope, nature, and purpose of Raidboxes GmbH’s access to data. Access is limited solely to what is necessary to fulfill the hosting services.