Privacy Policy

This Privacy Policy explains how WLF Energy GmbH ("WLF Energy," "we," "us," or "our") collects, uses, stores, shares, and protects your personal data when you access wlfenergy.de, our digital services, gated portals, contact and quote-request forms, newsletter, or any other channel referencing this Policy.

We respect your privacy and we are committed to protecting your personal data. This Policy is written in plain English and reflects our obligations under Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications and Digital Services Data Protection Act (TDDDG), and other applicable data protection laws.

Three sources of data: what you give us, what your device sends automatically, and what reaches us via business channels.

What you provide directly

• Name, salutation, professional title, email, phone, postal address
• Company, role, industry, country of operation
• Messages, project descriptions, product interest from forms
• Account credentials (passwords stored as cryptographic hashes, never plain text)
• Application materials — CV, cover letter, references
• Investor verification — qualification status, signed NDAs
• Newsletter preferences

What is collected automatically

• IP address, browser, OS, device type, screen resolution, language
• Pages visited, time spent, click paths, referring website
• Cookie identifiers (only with your consent — see Cookie Policy)
• Server log data: access time, requests, HTTP codes, data volume

What reaches us from third parties

• Business contacts shared by partners, suppliers, or customers
• Professional information from public databases (LinkedIn, company registers)
• Referrals — with your consent

Every processing activity has a defined purpose and a valid legal basis under Article 6 GDPR. No purpose creep. No data used outside what we tell you.

Our website is hosted by Kinsta Inc. on infrastructure inside the European Union, with a CDN that prioritises EU endpoints. A data processing agreement under Article 28 GDPR is in place.

When you visit, our hosting provider automatically stores server log files: IP address (anonymised where technically feasible), date and time, URL accessed, data volume, HTTP status, browser and OS, and referrer URL.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is operating the website securely, protecting against cyberattacks, and analysing technical issues.

Retention: Server log files are deleted or anonymised after seven (7) days, unless a security incident requires longer retention.

Different forms, different purposes, different retention. Here is the full list of touchpoints and how we treat each one.

Contact forms and inquiries. Name, email, optional phone and company, and your message — processed to respond to your inquiry under Art. 6(1)(b) and (f) GDPR. Retained for 12 months after closure.

Quote requests. Contact, project specifications, location, capacity needs, timeline, and budget — under Art. 6(1)(b) GDPR. Retained for up to 24 months from last contact if no contract results.

Newsletter. Email and preferences — under your consent, Art. 6(1)(a) GDPR. Retained until you unsubscribe; proof of unsubscribe kept for 3 years.

User accounts. Credentials and profile — under contract, Art. 6(1)(b) GDPR. Retained for account life plus 12 months.

Investor portal access. Identity verification, NDA, access logs — Art. 6(1)(b) and (f) GDPR. Retained for the relationship plus 6 years.

Press kit downloads. Email and media affiliation — Art. 6(1)(f) GDPR. Retained for 24 months.

Job applications. CV, cover letter, references — under § 26 BDSG and Art. 6(1)(b) GDPR. Rejected applications deleted after 6 months unless you consent to talent pool retention (24 months, renewable).

A short list of named processors, our group companies, project counterparties on a need-to-know basis, and authorities where law requires. We do not sell your data. We do not share it for third-party marketing.

Service providers (processors under Art. 28 GDPR DPAs)

• Kinsta Inc. — website hosting (EU infrastructure)
• CRM provider — sales pipeline (current details available on request)
• Email marketing provider — newsletter delivery
• Applicant Tracking System — recruitment
• Google Analytics — Google Ireland Ltd., consent only
• Meta Pixel — Meta Platforms Ireland Ltd., consent only
• LinkedIn Insight Tag — LinkedIn Ireland Unlimited Co., consent only
• Hotjar — Hotjar Ltd. (Malta), consent only

WLF Energy group companies. Including WLF Energy InfraCo B.V., for coordinating sales, projects, and investor relations. Legal basis: Art. 6(1)(f) GDPR — efficient internal administration of the corporate group (cf. Recital 48 GDPR).

Project partners and counterparties. On a case-by-case basis, limited to what is necessary, with confidentiality and data protection commitments in place. Legal basis: Art. 6(1)(b) or (f) GDPR.

Government authorities and professional advisors. Courts, regulators, attorneys, tax advisors, or auditors — where legally required or to establish, exercise, or defend legal claims.

Several providers above — notably Google, Meta, and LinkedIn — may transfer personal data outside the European Economic Area, principally to the United States. Where this happens, we apply safeguards under Chapter V of the GDPR.

Adequacy decisions. Where the recipient is certified under the EU–US Data Privacy Framework, transfers rely on the European Commission adequacy decision.

Standard Contractual Clauses. For transfers outside an adequacy decision, we rely on SCCs adopted by the European Commission under Art. 46(2)(c) GDPR.

Supplementary measures. Where appropriate, additional technical or contractual measures are applied based on a Transfer Impact Assessment.

No data is kept "just in case." Each category has a defined period — driven by purpose, contract, or statutory obligation. At the end of the period, data is securely deleted or anonymised across active systems, backups, and archives.

Under the GDPR, you have full rights over your personal data. To exercise any of them, write to legal@wlfenergy.de. We respond within one month, free of charge.

You may lodge a complaint with any EU/EEA supervisory authority — typically in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Under Article 32 GDPR, we implement appropriate technical and organisational measures aligned with ISO/IEC 27001 and the BSI IT-Grundschutz methodology.

• Role-based access control (RBAC) following the principle of least privilege
• Multi-factor authentication for sensitive systems
• Encryption of sensitive personal data at rest and in transit
• Pseudonymisation of personal data where appropriate
• Strong password complexity requirements and automatic session timeouts
• Physical access control to office premises via electronic systems
• Regular review of access rights and segregation of duties
• Documented incident response procedures

Our website is intended for adult users only. We do not knowingly collect personal data from anyone under the age of eighteen (18).

If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at legal@wlfenergy.de.

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, regulatory guidance, or our internal practices. The updated Policy will be published on this website with a revised effective date.

Where changes are material — for example, affecting the legal basis of processing, introducing new categories of recipients, or expanding processing purposes — we will notify you in advance through a prominent notice on the website or, if you have a user account, by email.

For any question, comment, or request regarding this Privacy Policy or our processing of your personal data, write to the Chief Legal Officer.

This Privacy Policy is one of six legal documents that govern your relationship with WLF Energy. The full set is published at wlfenergy.de.

Cookie Policy. Every cookie used on the site, its purpose, retention, and how to manage it.

GDPR Compliance Framework. Our governance, accountability, and data protection management system.

Impressum. Full legal notice as required under German law.

Disclaimer. Liability and intellectual property terms.

Terms of Use. Conditions for using wlfenergy.de.