Privacy Policy

1. Controller

WAV BAU | GEBÄUDETECHNIK GmbH
Rheinstraße 221
76532 Baden-Baden
Germany

Frankfurt am Main office:
45th floor / FOUR / T1
Große Gallusstraße 14
60315 Frankfurt am Main

Represented by:
Managing Director: Alexander Schumski

Commercial register:
Register court: Amtsgericht Mannheim
Registration number: HRB 737499

Email: info@wavgroup.de
Phone Baden-Baden: +49 (0)7221 – 396 11 66
Phone Frankfurt am Main: +49 (0)69 – 989 727 363

2. Hosting, server log files and technical delivery

Our website is hosted by Netlify, Inc. (510 Townsend Street, San Francisco, CA 94103, USA). When the website is accessed, Netlify processes technically necessary access data, in particular IP address, date and time of access, requested URL, referrer URL, browser and device information, operating system, HTTP status code and transferred data volume.

This processing is necessary to deliver the website, ensure stability and security, detect abuse and analyse errors. The legal basis is Art. 6(1)(f) GDPR. Log data is stored only as long as necessary for security, error analysis and documentation purposes.

Netlify is certified under the EU-US Data Privacy Framework. Where required, Standard Contractual Clauses under Art. 46 GDPR are used. Domain management and transactional email delivery are provided by Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus / EU).

3. Cookie and consent management

We use our own consent banner. Your selection is stored locally in your browser under the key wav_cookie_consent_v2. The selected categories, the consent banner version and the time of selection are stored. This storage is necessary to remember your decision. The legal basis is Art. 6(1)(f) GDPR and § 25(2) TDDDG.

Optional analytics and marketing technologies are loaded only after you actively select them or click “Accept all”. Without consent, Google Analytics and Meta Pixel are not loaded. You can change or withdraw your selection at any time via the Cookie settings link in the footer. If you withdraw consent, we attempt to delete analytics and marketing cookies already set in your browser.

For optional cookies, similar technologies and subsequent processing, the legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

4. Google Analytics 4 (analytics)

If you consent to the “Analytics” category, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us understand how the website is used. Page views, technical device information, browser information, approximate location data, referrers, interactions and random user identifiers may be processed. Cookies such as _ga and comparable identifiers may be set. According to Google, IP addresses of users from the EU are not logged or stored and are discarded before further processing.

Typical storage period: _ga up to 2 years, _gid up to 24 hours, where these cookies are set in the specific browser. The exact storage period may vary depending on Google configuration.

Data may be transferred to Google companies in third countries, in particular the USA. Google is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses under Art. 46 GDPR may be used. Processing takes place only on the basis of your consent. More information is available in Google’s privacy policy.

5. Meta Pixel (marketing)

If you consent to the “Marketing” category, we use Meta Pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Meta Pixel helps us measure advertising campaigns, evaluate contact and CTA events and make advertising more relevant. In particular, visited pages, clicks on contact options, CTA clicks, technical browser and device information, referrers, timestamps, IP address and cookie identifiers may be processed. Cookies such as _fbp or _fbc may be set. Meta may link this data to existing Facebook or Instagram accounts if you are logged in there or if Meta is able to make such an association.

Typical storage period: _fbp and _fbc up to 3 months, where these cookies are set in the specific browser. The exact storage period may vary depending on Meta configuration.

Data may be transferred to Meta companies in third countries, in particular the USA. Meta is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses under Art. 46 GDPR may be used. Processing takes place only on the basis of your consent. More information is available in Meta’s privacy policy.

6. Contact form, project enquiry and application/cooperation enquiries

When you use our contact form, we process the data you enter, in particular name, email address, phone number, message, project description, selected enquiry categories, project data, postal code, company information and position details. The fields shown depend on the selected enquiry path. Mandatory fields are required so that we can process your enquiry properly; additional information is voluntary.

The data is sent to us by email and recorded in our CRM system HERO Software GmbH (Schatzbogen 60, 81829 Munich, Germany) so that your enquiry can be processed in a structured way. The guided enquiry may also contain information about a potential cooperation or application. This information is processed as part of a contact request and is not operated as a separate applicant portal.

The required checkbox in the form confirms that you have taken note of this privacy policy. It is not a separate advertising consent. The legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual enquiries and Art. 6(1)(f) GDPR for structured processing, abuse prevention, documentation and CRM-based follow-up.

7. Optional newsletter and marketing consent

The optional “Newsletter and marketing consent” checkbox is not required and has no effect on the processing of your project or contact enquiry. Your enquiry is submitted to us regardless of this optional consent.

If you activate the optional checkbox, we additionally send you a confirmation email. Only after you confirm the link may we occasionally inform you by email about offers, news and services. The confirmation link contains an encrypted, time-limited token. To document confirmation, we process the time of confirmation, IP address, user agent and a token hash. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.

8. Google reviews

To display our Google reviews, we retrieve review data server-side via the Google Places API. No personal data of website visitors is transmitted to Google in this process. Author names and profile links are not passed to the frontend.

If you click a link to Google, you leave our website. From that point, Google processes your data under its own responsibility. Google’s privacy terms apply.

9. Recipients and processors

Recipients of personal data may include hosting providers, email service providers, CRM providers, technical maintenance providers and internally responsible persons at WAV BAU | GEBÄUDETECHNIK GmbH. Where service providers process personal data on our behalf, we use them as processors under Art. 28 GDPR.

Data is transferred to third parties only if this is necessary to process your enquiry, you have consented, there is a legal obligation or we have a legitimate interest.

10. Retention

Contact and project enquiries are stored only as long as necessary to handle the enquiry, carry out pre-contractual or contractual measures, comply with legal retention obligations or document evidence. Business communication may be subject to statutory retention obligations of up to 6 or 10 years depending on its content.

Consent proof is stored as long as necessary to document consent and defend against claims. Technical log data is stored only as long as necessary for security, error analysis and documentation purposes.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR) and withdrawal of consent (Art. 7(3) GDPR).

12. Right to complain

You may lodge a complaint with a data protection supervisory authority, in particular the Baden-Württemberg authority: www.baden-wuerttemberg.datenschutz.de.

13. Security

The website and form data are transmitted using TLS encryption. API keys and credentials are processed server-side and are not exposed in the browser. We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

14. No automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Last updated: July 2026