Privacy policy
This website works without cookies, without tracking services and, apart from the spam protection on the forms, without embedded third-party services. Everything we process is set out in full below.
1. Controller
WDM Webdesign München GmbH, Deisenhofener Str. 45, 81539 München, Germany, telephone +49 89 856 371 05, e-mail projekt@wdm.de, represented by its managing director Marie-Anne Le Corre. We are not required by law to appoint a data protection officer; please send any data protection enquiries to the address above.
2. Visiting the website (server log files)
When you visit this website, the web server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, browser type and operating system, and the previously visited page (referrer). This data is stored in server log files and deleted after 14 days at the latest. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website and protection against attacks.
The website is hosted in Germany by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp. We have concluded a data processing agreement with Mittwald under Article 28 GDPR.
All requests pass through the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare forwards the requests to the web server, protects the website against attacks and in doing so processes the same technical data, in particular your IP address. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure website that loads quickly. We have concluded a data processing agreement with Cloudflare that includes the EU standard contractual clauses; Cloudflare is also certified under the EU-U.S. Data Privacy Framework.
3. Forms and e-mail
If you use the "Request a demo" form (for a demo or for a question), we process the details you enter: the purpose of your enquiry, name, company, e-mail address, message and, optionally, telephone number, the type of your products, an appointment for the demo and your interest in taking part as a pilot customer. The data is sent to us by e-mail and used to deal with your enquiry and to prepare a possible contract. The legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) GDPR (answering enquiries).
If you choose an appointment for the demo, you will also receive a confirmation with a calendar entry by e-mail. The legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) GDPR (organising the appointment). To prevent an appointment from being booked twice, we store the booked time slot and a random identifier on our server until the appointment has passed, without any name or contact details. We read the available times from our own calendar. Only time slots are evaluated, not the content of other appointments, and none of your data is transmitted to the calendar provider.
The demo takes place via Google Meet, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You receive the link with the confirmation; you can join in your browser without a Google account. During the call, Google processes the data required for the connection, in particular IP address, device and connection data, the name you enter, and video and audio during the call. We do not record calls. A transfer to the USA cannot be ruled out; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) GDPR (our interest in holding the call in a simple way). If you would rather not use Google Meet, reply to the confirmation and we will find another way. Further information: Google's privacy policy.
In the CRA Applicability Check, you can have your result sent to you by e-mail. For this we process your e-mail address, optionally your name and company, and your answers in the check in the form of the result code. We send you the result and receive a copy ourselves so that we can follow up once if appropriate. The legal basis is Article 6(1)(b) GDPR (sending the result at your request) and Article 6(1)(f) GDPR (contacting you about our service). You can object to being contacted in this way at any time.
For the CRA Reporting Kit, we process your business e-mail address. We check that the domain can receive e-mail and does not belong to a free e-mail service or a disposable address service, send you a download link (valid for 30 days) and receive a copy ourselves so that we can follow up personally once if appropriate. When you request the kit, your browser transmits the page from which you came to the kit (the path of one of our pages or the host name of an external website); this information appears in our copy so that we can see which references to the kit are read. When you request and when you download the kit, we store for evaluation only the domain of your address, the time and, for the request, this origin. The legal basis is Article 6(1)(b) GDPR (sending the kit at your request) and Article 6(1)(f) GDPR (contacting you about our service); you can object to being contacted in this way at any time. If you tick the box for updates by e-mail, the following paragraph on the newsletter applies to you.
To protect against spam and automated submissions, we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, on all forms (demo request, result by e-mail, CRA Reporting Kit, newsletter, vulnerability report form). Turnstile is loaded only when you use a form, checks in the browser whether the input comes from a human, and to do so processes in particular your IP address and technical characteristics of your browser and device; only in case of doubt does a task appear for you to click. According to Cloudflare, Turnstile does not set cookies. A transfer to the USA is possible; Cloudflare is certified under the EU-U.S. Data Privacy Framework, and we have concluded a data processing agreement with Cloudflare. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the forms against misuse. The vulnerability report form also works without Turnstile, for example without JavaScript. Further information: Cloudflare's privacy policy.
To send the form e-mails, we use the Postmark service of ActiveCampaign, LLC, 1 North Dearborn Street, Chicago, IL 60602, USA. Your details from the form are transmitted to Postmark for this purpose. We have concluded a data processing agreement with ActiveCampaign that includes the EU standard contractual clauses; ActiveCampaign is also certified under the EU-U.S. Data Privacy Framework. Postmark stores message content for no more than 45 days.
We store enquiries until they have been dealt with, unless statutory retention obligations require us to keep them longer. If a contract is concluded, the retention periods under commercial and tax law of up to ten years apply.
4. Usage log of the CRA Applicability Check
To improve the CRA Applicability Check, we record on our own server how it is used: which question was answered with which answer and how many seconds that took, at which point a run ends and whether the browser tab moves to the background or is closed at that point, which result was shown and whether it was viewed to the end, whether the buttons for sharing, requesting a demo or sending by e-mail, or the references to the CRA Reporting Kit and the security.txt generator, were used, whether a mobile device or a desktop computer was used, and how you came to our website (host name of the referring website, first page visited, campaign parameters such as utm_source in the address). If you rate the result or write us a short comment about it, we also store this information; please do not enter names or contact details there. So that the steps of a run belong together, the browser assigns a random identifier and remembers the page on which you entered the website; both are kept in your browser's memory (sessionStorage) only while the browser tab is open and expire when it is closed. No cookies are set.
For each entry we also store the network from which the request came: your IP address in truncated form (for IPv4 without the last block, for IPv6 only the first 48 bits), the network operator (number and name of the autonomous system, such as your internet provider or your company's network) and the country, region and city as derived by Cloudflare from the IP address. We do not store the full IP address. We do not collect names, e-mail addresses or other details that would allow us to identify you directly; for companies with their own network, however, the network operator may indicate the organisation. We evaluate the entries only internally, to see who uses the check, for what reason and where it is unclear, and delete them after 24 months. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is improving the check and our service. You can object to this processing at any time, for example by e-mail to info@cra-response-center.de. No third-party services are used, apart from Cloudflare as processor for forwarding the requests (section 2).
5. security.txt generator and security.txt checker
The security.txt generator and checker moved to security-txt.eu on 11 October 2026; their use is governed by the privacy policy of security-txt.eu. The records created on this website until then (functions used, domains entered or checked, type of findings, without IP address and without file content) are now evaluated only statistically and deleted no later than 31 October 2028. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is evaluating how the tools were used.
6. Reporting vulnerabilities
You can report security vulnerabilities to us via the report form and the addresses psirt@, csirt@ and security@cra-response-center.de. In doing so, we process the content of your report and, only if you provide them, your name or alias and your e-mail address or telephone number. We send the details from the form via Postmark (ActiveCampaign, LLC, USA) as an e-mail to our mailbox at Mittwald; on the server we store only when a report was received, which area it concerned and whether it was anonymous, not its content. The purpose is to examine and remedy the reported vulnerability and to respond to you. The legal basis is Article 6(1)(f) GDPR (legitimate interest in the security of our services) and Article 6(1)(c) GDPR where a notification to authorities under Article 14 of Regulation (EU) 2024/2847 becomes necessary. We do not pass on your contact details to third parties without your explicit consent. We publish your name or alias in the acknowledgements only if you wish. We delete the report once the process has been completed and no retention obligation applies. Reports can also be made anonymously.
7. Audience measurement with Plausible
To understand which pages are read and where visitors come from, we use Plausible Analytics from Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible does not set cookies and stores nothing on your device. It records the page visited, the referring website, any campaign parameters in the address, browser, operating system, device class, the country and region derived from the IP address, how far and for how long a page was read, as well as clicks on external links, downloads and form submissions (without their content). Measurement runs through our own server: your browser sends the data to our domain, and our server passes it on to Plausible. Your IP address and your browser's identifier (user agent) are not stored in the process; Plausible combines them with a random value that changes daily to form a hash for counting visits within one day, and deletes the random value after 24 hours. This makes it impossible to recognise you across several days or websites. Plausible stores the data on servers in the EU (Germany); we have concluded a data processing agreement with Plausible. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is improving our service. Further information: Plausible's data policy.
8. No cookies, no embedded services
This website does not set cookies. Fonts are loaded from our own server, not from Google or other providers. No third-party maps, videos, social media buttons or chat services are embedded. The only exception is the Cloudflare Turnstile spam protection on the forms (section 3).
9. Recipients
The only recipients of your data are the processors named in this policy (Mittwald, Cloudflare, Plausible, ActiveCampaign/Postmark) and, if you take part in a demo, Google for Google Meet. For vulnerability reports, the content, without your contact details, may be passed to the competent CSIRT (CERT-Bund, the CSIRT of the German Federal Office for Information Security, BSI) or to ENISA if we are obliged to notify (section 6). Data is transferred to third countries only by Cloudflare, by the Postmark mailing service and, where applicable, by Google Meet, to the USA, on the basis of the EU-U.S. Data Privacy Framework and the EU standard contractual clauses.
10. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on Article 6(1)(f) GDPR (Article 21). To exercise these rights, please contact the address given in section 1. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
11. Changes
We update this policy when the website or the legal position changes. Last updated: October 2026.