Privacy Policy
This notice explains how we protect your personal data, which is a top priority for us. We have implemented all necessary technical and organisational measures to ensure compliance with applicable data protection laws and regulations and continuously review and improve these measures.
To make this Privacy Policy easier to understand, we first explain a few key terms used in the General Data Protection Regulation (GDPR).
Personal data refers to any information relating to an identified or identifiable natural person. A person may be identified directly or indirectly, in particular by reference to an identifier or to one or more characteristics specific to that person.
Typical examples of directly identifying personal data include name, address, email address, telephone number, location data and date of birth. Examples of indirectly identifying personal data include IP addresses and user data stored in server log files.
Data subject means an identified or identifiable natural person whose personal data is processed.
Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future.
Profiling means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller or the specific criteria for its nomination may be provided for by Union law or by the law of the Member States.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, agency or other body to whom personal data is disclosed, whether or not it is a third party. However, public authorities which may receive personal data in the context of a particular inquiry in accordance with Union law or the law of a Member State are not regarded as recipients. The processing of such data by those public authorities complies with the applicable data protection rules in accordance with the purposes of the processing.
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Please note that,
- data transmission over the Internet (e.g. when communicating via email) may be subject to security vulnerabilities, and that it is not possible to completely protect data against access by third parties.
- your browser transmits your IP address when you visit our website. The IP address is required to uniquely identify the device you are using for data transmission.
Responsible Controller
This Privacy Notice applies to the processing of personal data by
WPW GmbH
Hochstraße 61
66115 Saarbrücken
Tel.: +49 681 99 20 0
Fax: +49 681 99 20 100
Legally represented by (Management)
Data Protection Officer
Our Data Protection Officer can be contacted as follows:
ZEiD GmbH
Email: DSB@zeid.de
Categories of Personal Data, Purposes, and Legal Bases
Server Log Files
When you visit our website https://www.wpw.de, the provider—
(intersaar GmbH, Heinrich-Barth-Str. 23, 66115 Saarbrücken) automatically and temporarily collects information in so-called server log files, which your browser automatically transmits to us and stores until it is automatically deleted. This includes:
- IP address of the requesting computer
- Browser type and browser version
- Operating system used
- Name and URL of the retrieved file
- Referrer URL (website from which the access originated)
- Hostname of the accessing computer (name of your access provider)
- Date and time of the server request
This data cannot be attributed to specific individuals. This data is not combined with other data sources. We reserve the right to review this data at a later date if we become aware of specific evidence of unlawful use.
The data is processed for the following purposes:
Establishing a connection, ensuring stable and convenient use, evaluating system security, and administering our website.
The legal basis is Article 6(1)(f) of the GDPR. Operating a website constitutes a legitimate interest.
Cookies
Some of our web pages use so-called cookies. Cookies do not cause any damage to your computer and do not contain viruses. Cookies are used to make our website more user-friendly, effective, and secure, as well as for statistical analysis. Cookies are small text files that your browser automatically creates when you visit our website and stores on your device.
Most of the cookies we use are so-called “session cookies”. They are automatically deleted at the end of your visit.
Other cookies remain stored on your device until you delete them. These cookies allow us to recognise your browser the next time you visit. They store the information and settings you have entered so that you do not have to enter this information again.
You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis. You can also disable cookies for specific cases or in general, and enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be limited.
The data is processed for the purposes stated.
The legal basis is Article 6(1)(f) of the GDPR. Operating the website is in our legitimate interest or that of a third party.
We use tracking cookies and non-essential cookies only if you have previously given your express consent. Tracking cookies show, among other things, which pages you have already visited and are used for statistical purposes (analysis and improvement of our website).
A detailed overview and the option to manage cookies, change, withdraw or give consent are available here.
The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR.
Web Design/Fonts
Adobe Fonts (Typekit)
We use Adobe web fonts on our website to ensure that our website is displayed in a consistent and appealing design.
We have purchased a licence to use the WebFonts and entered into a data processing agreement with Adobe.
The service provider is Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland (for Europe). Data processing may also take place in the United States. Adobe is certified under the Adequacy Decision for data transfers to the United States.
The fonts are hosted by Adobe. When the web fonts are transmitted, Adobe processes your IP address.
You can view Adobe’s privacy policy at the following link
https://www.adobe.com/de/privacy/eudatatransfers.html
You can view the Adobe Fonts for Websites Privacy Policy below:
https://www.adobe.com/de/privacy/policies/adobe-fonts.html
The legal basis is Article 6(1)(f) of the GDPR, based on our legitimate interest stated above.
Contact Form
To the extent that direct personal data, such as name, address, email addresses, telephone numbers, etc., is collected via contact forms on our website, this is always done on a voluntary basis wherever possible. This data will not be disclosed to third parties without your express consent and will be deleted once your enquiry has been processed.
The data is processed for the purpose of establishing contact and submitting a statement.
The legal basis is your consent pursuant to Article 6(1), sentence 1, subparagraph (a) of the GDPR.
Privacy Notice: Job Application Process via Our Website
Description of Data Processing
When submitting application documents via our website (job advertisements are hosted and managed by our processor, HR4YOU), the following data is requested:
- Salutation
- Surname
- First Name
- Telephone/mobile number
- Remarks
- Your Voluntary Consents
Permission for longer-term storage of the data and its use for positions to be filled at a later date
Permission to disclose application documents within the WPW Group of companies.
Document Upload
- CV
- Personalized Cover Letter (optional)
- Certificates and school-leaving/final certificates (optional)
- Employment references (optional)
Legal Basis for Data Processing
Section 26 of the German Federal Data Protection Act (BDSG), in conjunction with Article 88 of the GDPR and Article 6(1)(b) of the GDPR, forms the legal basis for establishing an employment relationship.
If you give us your permission or consent for disclosure within the corporate group or for longer-term storage, Article 6(1)(a) of the GDPR forms the legal basis.
As part of our legitimate interest pursuant to Article 6(1)(f) of the GDPR, we anonymise the application characteristics received so that we can use the anonymised data to evaluate our job advertisements in terms of efficiency, success, and media reach.
Purpose of the processing
Data processing ensures that the application process is carried out and, in the event of a rejection, creates an applicant pool for future vacancies, subject to your consent.
Retention period
Your personal data will be deleted as soon as the purpose for which it was collected no longer applies, unless we are required by law to retain it. As a general rule, your personal data will be deleted no later than 10 years after the end of the employment relationship. Personal data of rejected applicants will be deleted 7 months after the conclusion of the application process. Unless you have given us your consent to longer-term storage or disclosure within the group. In that case, the data will be deleted no later than 2 years after the end of the application process or after the retention period requested by you.
We delete the anonymised data after 5 years.
Right to Withdraw Consent
Any applicant (m/f/d) may withdraw their consent to processing (longer-term storage and disclosure within the corporate group) at any time with effect for the future. The withdrawal must be submitted in writing or electronically by email to personal@wpw.de.
As of December 2025
Legitimate Interests
We operate our websites to present our company and our services and to increase our reach.
Disclosure of Data to Recipients or Categories of Recipients
Indirect personal data may be disclosed to web hosting providers, plugin providers for tools, IT service providers, etc. For further information, please refer to Section 15, “Tools Used”, in this Privacy Notice.
We only disclose your direct personal data to third parties if the following conditions are met:
- Express consent has been given in accordance with Article 6(1)(a) of the GDPR.
- The processing is necessary to safeguard the legitimate interests of the controller pursuant to Article 6(1)(f) of the GDPR, unless the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data take precedence.
- The processing is necessary to fulfil a legal obligation pursuant to Article 6(1)(c) of the GDPR to which the controller is subject.
- The processing is necessary for the performance of a contract pursuant to Article 6(1)(b) of the GDPR to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.
Transfer of Data to a Third Country
We do not intend to transfer your direct personal data, such as your name, address, email addresses, telephone number, date of birth, etc., to a third country. However, when using the Internet, technical data such as IP addresses or other technical user data (e.g. cookies) are also transmitted.
To the extent that tools/plugins are used on our website, indirect personal data may be transferred to the United States. This transfer takes place on the basis of contractual agreements (e.g. Standard Data Protection Clauses or the Data Privacy Framework) with our contractual partners, which ensure an adequate level of data protection. For further information, please refer to Section 15, “Tools Used”, or to this Privacy Notice.
Duration of Storage
As stated in this Privacy Notice, your personal data will be deleted as soon as the purpose for which it was collected no longer applies, unless we are required by law to retain it.
Right of Access, Rectification, Erasure, Restriction, Objection, and Data Portability
You have the right to access the personal data concerning you (Article 15 GDPR), including the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom your data has been or will be disclosed, particularly recipients in third countries, and the planned retention period. If the data was not collected by us, you have the right to information regarding the origin of the data. In addition, you have the right to rectification (Article 16 GDPR), erasure of your data (Article 17 GDPR), or restriction of processing (Article 18 GDPR), as well as the right to data portability (Article 20 GDPR). The right to data portability includes the provision of your personal data in a structured, commonly used, and machine-readable format so that the data can be transmitted to another controller without hindrance.
In addition, you have the right to object to processing (Article 21 GDPR) if we process your data on the basis of a legitimate interest asserted by us (Article 6(1)(f) GDPR) and you have reasons arising from your particular situation, or if the objection is directed against direct marketing. In the latter case, you may object without having to specify a particular situation.
Withdrawal of Consent
To the extent that you have given us your consent to process your personal data, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal (Article 7(3) GDPR).
You can exercise your rights to object or withdraw consent by contacting the controller or Data Protection Officer using the contact details provided.
Right to Lodge a Complaint
You have the right to lodge a complaint with the supervisory authority at your place of residence (Article 77 GDPR).
In Saarland:
Independent Data Protection Centre Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Tel. 0681 947810
Requirement to Provide Personal Data
You are under no legal or contractual obligation to provide us with your personal data. However, the provision of your indirect personal data (IP address, cookies) is required in order to visit our website.
Automated Decision-Making
We do not engage in automated decision-making based on personal data, including profiling and scoring.
Processing for Other Purposes
We do not process personal data for purposes other than those for which it was collected. Should this become necessary, we will provide you with information about this other purpose and all other relevant details prior to such processing.
Data Security
We use SSL (Secure Sockets Layer) on our website. Data transmission is encrypted using 256-bit encryption, provided your browser supports it. Otherwise, 128-bit encryption is used. You can recognise the encrypted connection by a padlock icon in your browser.
In addition, we have implemented technical and organisational measures to ensure the ongoing security of your data.
Tools/Plugins/Links Used on This Website
This website uses tools/plugins/links from various providers.
If you follow a link, you will leave our website. The respective website operator is responsible for its content.
Google Maps
This website contains a link to Google Maps, a product of Google. The operator of Google Maps in the EEA and Switzerland is Google Ireland Limited, a company incorporated and operating under Irish law (registration number: 368047), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. By clicking the link on this website to Google Maps, you consent to the collection, processing, and use of automatically collected data by Google Inc., its representatives, and third parties. The Google Maps Terms of Service can be found at:https://www.google.com/intl/de_US/help/terms_maps.html.
The data is processed for the following purposes:
Finding our location using an internet-based mapping service.
The legal basis is Article 6(1), sentence 1, subparagraph (a) of the GDPR.
Information on Data Processing on Our Social Media Pages
We operate company pages on various social media platforms.
We use these platforms to inform our customers and prospective customers about our services, news, and events. At the same time, they give us the opportunity to receive feedback and suggestions.
The operation of these company pages is based on the legitimate interests mentioned above pursuant to Article 6(1)(f) of the GDPR.
In some cases, we have included links to these platforms on our website.
If you follow these links by clicking on them, you will leave our website. This is done on the basis of your consent.
Social Media Links with Consent, Art. 6 (1), Sentence 1, Subparagraph a of the GDPR
The data is processed for the following purposes:
Advertising, Increasing Awareness of the Website
The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR to access the social media platform by clicking the link.
The respective social media providers are responsible for data processing on their platforms.
When you click the link to LinkedIn, your browser connects to the servers of LinkedIn Ireland Unlimited Company.
Information about which data LinkedIn processes and how it processes it can be found in LinkedIn’s Privacy Policy: https://de.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
Data transfers from LinkedIn to third countries that comply with data protection regulations are governed by LinkedIn’s responsibility and privacy policy.
LinkedIn provides us with anonymised statistics for our LinkedIn Company Page, which give us insights into how visitors use our page. This processing of information (Page Insights) is carried out jointly by LinkedIn and us as joint controllers.
This processing is based on our legitimate interests in improving our page and increasing our reach.
The legal basis is Article 6(1)(f) of the GDPR
As part of our joint responsibility, we have entered into a joint controller agreement with LinkedIn Ireland Unlimited Company. Details of the division of responsibilities can be found at:
https://legal.linkedin.com/pages-joint-controller-addendum
As a data subject, you can exercise your rights (see “Right of Access, Rectification, Erasure, Restriction, Objection, and Data Portability”) directly with LinkedIn, or we can forward your request to LinkedIn:
https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de
The lead supervisory authority in this case is the Irish Data Protection Commission.
When you click the link to XING, your browser connects to the servers of New Work SE at Strandkai 1, 20457 Hamburg, Germany.
Information about which data XING processes and how it processes it can be found in XING’s Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung
Data transfers from XING to third countries that comply with data protection regulations are governed by XING’s responsibility and privacy policy.
XING provides us with the opportunity to present our company page to a wider audience and to get in touch with people.
This processing is based on our legitimate interests in improving our page and increasing our reach.
The legal basis is Article 6(1)(f) of the GDPR
Tools/Plugins Based on Consent, Art. 6(1), Sentence 1, Subparagraph (a) of the GDPR
These tools/plugins are integrated using the two-click method. This means that these tools are only activated with your express consent.
Status of this Privacy Notice
This Privacy Notice is dated 15 December 2025. It is subject to change if the content of our website changes, legal regulations change, or official requirements need to be implemented.
© 2025 ZEiD GmbH. This privacy policy is protected by copyright.