1. Controller

WAV BAU | GEBÄUDETECHNIK GmbH
Rheinstraße 221
76532 Baden-Baden
Germany

Frankfurt am Main branch:
45th floor / FOUR / T1
Große Gallusstraße 14
60315 Frankfurt am Main

Managing Director: Alexander Schumski
Register court: Amtsgericht Mannheim
Registration number: HRB 737499

Email: info@wavgroup.de
Phone Baden-Baden: +49 (0)7221 – 396 11 66
Phone Frankfurt am Main: +49 (0)69 – 989 727 363

2. Hosting, server logs and email

This website is delivered by Netlify, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. Netlify processes technically required access data such as IP address, date and time, requested URL, referrer, browser and device data, operating system, HTTP status and data volume. This is necessary for delivery, stability, security, abuse prevention and troubleshooting. The legal basis is Art. 6(1)(f) GDPR.

Netlify is certified under the EU-US Data Privacy Framework; where required, Standard Contractual Clauses under Art. 46 GDPR are also used. Domain management and business email are provided through Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (EU).

3. Consent management

Your choice is stored locally in your browser under wav_cookie_consent_v3. The selected categories, banner version and time of selection are stored so that we can respect your decision. The legal basis is Art. 6(1)(f) GDPR and Section 25(2) TDDDG.

Google Analytics and Meta Pixel are loaded only after active consent. You can change or withdraw your choice at any time via Cookie settings in the footer. The legal bases for optional technologies are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

4. Google Analytics 4

With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Page views, interactions, referrers, browser and device data, approximate location, IP address and pseudonymous identifiers may be processed. In particular, _ga and _ga_YJLWRFC0SY may be set for up to two years depending on the configuration.

Data may be transferred to Google companies in the USA. Google is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses may also be used. More information: Google Privacy Policy.

5. Meta Pixel

With your consent, we use Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Pages visited, contact and CTA clicks, referrers, timestamps, IP address, browser and device data and identifiers such as _fbp and _fbc may be processed. Meta may associate data with Facebook or Instagram accounts. Cookie retention is typically up to three months, depending on configuration.

For collection and transfer of event data to Meta, we and Meta are joint controllers under Meta's terms (Art. 26 GDPR). Meta is independently responsible for subsequent processing. Details: Controller Addendum and Meta Privacy Policy. Data may be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework.

6. Contact forms, project and cooperation enquiries

When you use our forms, we process the data you provide, including name, email, phone, message, project description, selected enquiry categories, project data, postal code, company and position. Required fields are needed to process the enquiry; other information is voluntary.

Data is sent to us by email and recorded for structured processing both in the CRM solution of HERO Software GmbH, Schatzbogen 60, 81829 Munich, Germany, and in Bitrix24, provided in Europe by Alaio Cloud Limited, Frema House, Office 102, No. 9 Constantinou Paparigopoulou Street, 3106 Limassol, Cyprus. We transfer to Bitrix24 in particular your name, email address, telephone number, enquiry type and message content. Processing serves to allocate, handle, document and follow up your enquiry.

The legal basis is Art. 6(1)(b) GDPR for contractual and pre-contractual enquiries and Art. 6(1)(f) GDPR for structured processing, abuse prevention, documentation and CRM follow-up. HERO Software and Alaio Cloud Limited are engaged as processors pursuant to Art. 28 GDPR. According to Bitrix24, customer accounts in the bitrix24.de and bitrix24.eu domain zones are hosted in AWS data centres in Frankfurt am Main. Where Bitrix24 or its subprocessors process data outside the European Economic Area, this takes place only on the basis of an adequacy decision under Art. 45 GDPR or appropriate safeguards, in particular Standard Contractual Clauses under Art. 46 GDPR. Further information: Bitrix24 and the GDPR and the Bitrix24 Privacy Policy.

The server-side transfer to the CRM systems does not place additional cookies on your device and does not access previously stored analytics or marketing cookies.

7. Optional newsletter and marketing consent

This optional consent is not required and does not affect your enquiry. If activated, we send a confirmation email. Only after confirmation may we occasionally inform you by email about offers, news and services. To document confirmation, we process the confirmation time, IP address, user agent and a token hash. The legal basis is Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with future effect.

8. Google reviews and external content

Review data is retrieved server-side through the Google Places API; visitor data is not transmitted to Google for this request. Author names and profile links are not sent to the frontend. If you follow an external link, the respective provider is responsible for subsequent processing.

Logos of affiliated companies may be loaded from wavgroup.de. The receiving server may process IP address, referrer, browser and device data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a consistent presentation of WAV Group.

9. Recipients and processors

Recipients may include hosting, email, CRM and technical service providers and internally responsible persons. These include in particular Netlify, Hostinger, HERO Software and Alaio Cloud Limited (Bitrix24), together with their contractually engaged subprocessors. Providers processing data on our behalf are engaged under Art. 28 GDPR. Data is otherwise disclosed only where necessary, based on consent, a legal obligation or a legitimate interest.

10. Retention

Contact and project enquiries are retained only as long as required for processing, contractual or pre-contractual measures, evidence and statutory retention. This also applies to CRM records stored in HERO and Bitrix24. Depending on type and content, business records may be subject to statutory retention periods of 6, 8 or 10 years. Consent records and technical logs are retained only as long as needed for documentation, security and legal defence.

11. Your rights

You have rights to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing under Art. 6(1)(f) (Art. 21) and withdrawal of consent (Art. 7(3)).

12. Right to complain

You may complain to a supervisory authority, in particular the Baden-Württemberg authority: www.baden-wuerttemberg.datenschutz.de.

13. Security

The website and form data are transmitted using TLS encryption. API keys and credentials are processed server-side. We use appropriate technical and organisational measures to protect personal data.

14. No automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Last updated: September 2026