Data protection

(1) Below, we provide information on the collection of personal data when you use our website. Personal data refers to any data that can be linked to you personally, e.g. your name, address, email address and user behaviour.

(2) The controller within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR) is

DR. KURT WOLFF GMBH & CO. KG
Johanneswerkstraße 34–36
33611 Bielefeld

You can contact our Data Protection Officer at dpo@drwolffgroup.com or by post, marking your correspondence ‘for the attention of the Data Protection Officer’.

(3) When you contact us by email or via a contact form, we will store the data you provide (your email address, your name and telephone number where applicable, and any other personal data you include in your message) in order to answer your enquiries. We will delete the data collected in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply. When using a contact form, data processing takes place with your consent in accordance with Article 6(1)(a) of the GDPR and may be necessary in accordance with Article 6(1)(b) of the GDPR for the processing of your enquiry or in accordance with Article 6(1)(c) of the GDPR to fulfil a legal obligation. If you send us an email, data processing is required in accordance with Article 6(1)(b) of the GDPR to process your enquiry and/or in accordance with Article 6(1)(c) of the GDPR to comply with a legal obligation.

(4) If we use third-party service providers for specific functions of our website or wish to use your data for marketing purposes, we will provide detailed information below regarding the relevant processes. We will also specify the criteria governing the retention period.

You have the rights set out below, subject to the relevant legal requirements being met. To exercise these rights, you may contact us using the contact details provided. However, we would prefer you to use the following email address: kw-verkauf@drwolffgroup.com.

• Article 15 of the GDPR – The data subject’s right of access:

You have the right to request confirmation from us as to whether personal data concerning you is being processed, and if so, what data is being processed and the specific circumstances of the data processing.

• Article 16 of the GDPR – Right to rectification:

You have the right to request that we rectify any inaccurate personal data concerning you without delay. Taking into account the purposes of the processing, you also have the right to request that incomplete personal data be completed, including by means of a supplementary statement.

• Article 17 of the GDPR – Right to erasure:

You have the right to request that we erase any personal data relating to you without delay.

• Article 18 of the GDPR – Right to restriction of processing:

You have the right to request that we restrict the processing of your data.

• Article 20 of the GDPR – Right to data portability:

Where processing is based on consent or on the performance of a contract, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from us, or to have the data transmitted directly to the other controller, where technically feasible.

• Article 21 of the GDPR – Right to object:

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on our legitimate interests or is necessary for the performance of a task carried out in the public interest, or is carried out in the exercise of official authority.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Where we process your personal data for the purposes of direct marketing, you have the right to object to such processing at any time. If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for those purposes.

You may lodge an objection at any time, with effect for the future, via any of the contact details provided.

• Article 77 of the GDPR in conjunction with Section 19 of the BDSG – Right to lodge a complaint with a supervisory authority:

You have the right to lodge a complaint at any time with a supervisory authority, in particular in the Member State of your residence, your place of work or the place where the alleged infringement occurred, if you consider that the processing of your personal data infringes applicable law.

• Withdrawal of consent:

You may withdraw your consent at any time with future effect by contacting us via any of the contact details provided.

(1) When you use the website for information purposes only – that is, if you do not register or otherwise provide us with information – we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis is Article 6(1)(f) of the GDPR):

• IP address
• Date and time of the enquiry
• Time difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• the amount of data transferred in each instance
• Website from which the request originates
• Browser
• Operating system and its user interface
• Language and version of the browser software.

(2) In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, and through which certain information is transmitted to the entity that sets the cookie (in this case, us). Cookies cannot run programs or transmit viruses to your computer. They serve to make the website more user-friendly and effective overall.

(3) Use of cookies:

a) This website uses the following types of cookies, the scope and functionality of which are explained below:

• Transient cookies (see b)
• Persistent cookies (see c).

b) Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These store a so-called session ID, which allows various requests from your browser to be associated with the same session. This enables your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close your browser.

c) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete these cookies at any time via your browser’s security settings.

d) You can configure your browser settings as you wish and, for example, refuse to accept third-party cookies or all cookies. Please note that you may not be able to use all the features of this website.

e) We use cookies to identify you on subsequent visits.

(4) Consent management:

Using data protection management software, we offer you the option to consent to the storage of cookies in a manner that complies with the law and to ensure that you can withdraw your consent. Consent is documented to fulfil our obligation to provide evidence, and the setting of cookies is controlled technically. To this end, cookies are used that store your cookie settings on our websites. Your cookie settings can be retained for future visits to our platforms, provided you do not delete the cookies beforehand. You can adjust your settings at any time. Mandatory statutory retention periods remain unaffected.

Categories of data: To obtain, manage and record your consent, we store your IP address, the date of your consent, a pseudonymous ID and your chosen settings.

Recipient: OneTrust, 82 St John Street, Farringdon, London EC1M 4JN, United Kingdom (“OneTrust”). OneTrust is based in the United Kingdom. The European Commission has adopted an adequacy decision regarding data transfers to the United Kingdom, which confirms that an adequate level of protection exists for the processing of personal data.

Transfers to third countries:the standard contractual clauses here, here and here.

Legal basis: The legitimate interest in pursuing the stated purposes (Article 6(1)(f) of the GDPR).

Retention period: The data is stored for 365 days and then deleted.

Privacy policy: https://www.onetrust.com/privacy-notice/

(1) In addition to the purely informational use of our website, we offer various services which you may use if you wish. To do so, you will generally need to provide further personal data, which we use to provide the relevant service and to which the aforementioned data processing principles apply.

(2) In some cases, we use external service providers to process your data. These providers have been carefully selected and appointed by us, are bound by our instructions, and are subject to regular monitoring.

(3) Furthermore, we may share your personal data with third parties if we offer promotions, competitions, contracts or similar services in collaboration with partners. You will receive further information on this when you provide your personal data or in the description of the offer below (e.g. in the relevant terms and conditions).

(4) Where our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the implications of this in the description of the service.

We use additional services on this website for web analytics, monitoring and optimisation.

Purposes: Web analytics is used to analyse visitors to our website and may include pseudonymised data on visitors’ behaviour, interests or demographic information, such as gender. This enables us, for example, to identify at what times our website, its functions or its content are used most frequently. Furthermore, it enables us to identify which areas require optimisation. In addition to web analytics, we may also use testing procedures to, for example, test and optimise different versions of our online offering or its components.

Categories of data:

• Interests
• Pseudonymous usage data (e.g. websites visited and the elements used on them), user interactions (e.g. records of your mouse movements, clicks, scrolling movements and depth, and interactions with website elements)
• Technical data (e.g. device information, operating system, browser (type, version), screen resolution and language settings)
• Meta/communication data (e.g. IP address, referrer URL (the previously visited page), and the date and time of access)

Where possible, we use an IP masking method (i.e. pseudonymisation by truncating the IP address)

• Demographic and geographical data (e.g. geographical location based on the IP address)

Provided that users have consented to the collection of their location data, this data may also be processed, depending on the provider

Service providers used:

(1) Google services

We use the following services provided by Google for web analytics, monitoring and optimisation:

• Google Analytics
• Google AdWords
• DoubleClick

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Transfers to third countries: Data may be transferred by Google to recipients in third countries for these purposes. Google has concluded standard contractual clauses with the respective recipients for these purposes, unless an adequate level of protection exists on the basis of a Commission decision. You can access the standard contractual clauses here, here and here.

Privacy policy: https://policies.google.com/privacy?hl=de

(2) Sentry

Supplier: Functional Software Inc., 132 Hawthorne Street, San Francisco, CA 94107, USA

Transfers to third countries: Data may be transferred by Sentry to recipients in third countries for these purposes. Sentry, or rather Functional Software, is an active participant in the EU-US Data Privacy Framework, which governs the correct and secure transfer of personal data of EU citizens to the USA. Sentry has also concluded standard contractual clauses with the respective recipients, unless an adequate level of protection exists on the basis of a Commission decision. You can access the standard contractual clauses here, here and here.

Privacy policy: https://sentry.io/privacy/

(3) Microsoft Clarity 

Purpose: Microsoft Clarity is an analytics tool that provides insights into user behaviour by generating so-called ‘heatmaps’ and recording individual user sessions (session replays).

These analyses help us to identify usage patterns, detect technical errors and optimise the design and content of our website in a targeted manner.

• Heatmaps show us visually which areas of our website are clicked on or viewed most frequently.
• Session replays allow us to view anonymised recordings of individual visits in order to understand how visitors interact with our site (e.g. through mouse movements, clicks and scrolling behaviour).

Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.  

Transfers to third countries: Data may be transferred to recipients in third countries. Microsoft Clarity states that it masks sensitive data before forwarding it to Microsoft.
Microsoft is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data belonging to EU citizens to the US.  
Further information on this can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_enthe standard contractual clauseshere, here andhere.

Legal basis: The legitimate interest in pursuing the stated purposes (Article 6(1)(a) of the GDPR).  

Retention period: The data is retained for a maximum of 13 months and is then automatically deleted.

Privacy Policy: https://www.microsoft.com/de-de/privacy/privacystatement 

We use additional remarketing and conversion tracking services on this website.

Purposes: We use various remarketing and conversion tracking technologies on our website. This enables us to show our users adverts tailored to their interests. We analyse user interactions on our website, enabling us to display targeted advertising to users on other websites or platforms even after they have visited our website. We also receive information from the respective platforms regarding the success of our advertising campaigns, which we in turn use to optimise our advertising activities.

Categories of data:

• Anonymous usage data (e.g. websites visited, elements used on those sites and technical details, access times), meta/communication data (e.g. device information).
• Interests
• Demographic information
• Provided that users have consented to the collection of their location data, this data may also be processed, depending on the provider.

Service providers used:

(1) Google services

We use the following services provided by Google for web analytics, monitoring and optimisation:

• Google Analytics
• Google AdWords
• Google Remarketing
• DoubleClick

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Transfers to third countries: Data may be transferred by Google to recipients in third countries for these purposes. Google has concluded standard contractual clauses with the respective recipients for these purposes, unless an adequate level of protection exists on the basis of a Commission decision. You can access the standard contractual clauses here, here and here. 

Privacy policy: https://policies.google.com/privacy?hl=de

(2) TikTok Analytics

Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

Transfers to third countries:the standard contractual clauses here, here and here.

Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE

(3) Adform

Provider: Adform A/S, Silkegade 3 B, 1113 Copenhagen K.

Transfers to third countries:the standard contractual clauses here, here and here.

Privacy policy: https://site.adform.com/privacy-center/platform-privacy/

(4) Outbrain Amplify

Supplier: First Floor Craven House, 121 Kingsway, London WC2B 6PA, United Kingdom

Transfers to third countries:the standard contractual clauses here, here and here.

Privacy policy: https://www.outbrain.com/privacy/

(5) Taboola

Provider: Taboola Germany GmbH, Alt-Moabit 2, 10557 Berlin.

Transfers to third countries:the standard contractual clauses here, here and here.

Privacy policy: https://www.taboola.com/policies/privacy-policy

(5) Facebook Custom Audiences

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Transfers to third countries: Data may be transferred from Facebook to recipients in third countries. Meta Platforms, Inc. has certified its participation in the EU-US Data Privacy Framework. Meta Ireland relies on the EU-US Data Privacy Framework and the European Commission’s adequacy decision for transfers to third countries regarding the transfer of European data to Meta Platforms, Inc. in the US, as set out in Meta’s Data Privacy Framework disclosure. Meta Ireland may also use alternative transfer mechanisms, provided these are recognised by the GDPR and other applicable data protection laws in the EEA and Switzerland.

Privacy policy: https://www.facebook.com/about/privacy;

to logged-in users at https://www.facebook.com/settings/?tab=ads#.

(7) Pinterest Conversion Insights

Provider: Pinterest Europe Ltd., 2nd Floor, Palmerston House, Fenian Street, Dublin 2.

Transfers to third countries: Data may be transferred from Pinterest to recipients in third countries. Pinterest has entered into standard contractual clauses with the respective recipients for these purposes, unless an adequate level of protection is ensured by a Commission decision. You can view the standard contractual clauses here, here and here.

Privacy policy: https://policy.pinterest.com/de/privacy-policy

Last updated: 23 March 2026