Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

Big Wolf Business Owner: Saad Dyab Wehldorfer Str. 25 27616 Beverstedt Germany

Email: info@bigwolfbusiness.com Phone: +49 1578 0958196

2. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), as well as the right to object (Art. 21) and to withdraw consent already given (Art. 7 para. 3). To exercise your rights, an informal email to info@bigwolfbusiness.com is sufficient.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Our competent supervisory authority is:

Die Landesbeauftragte für den Datenschutz Niedersachsen Prinzenstraße 5, 30159 Hannover, Germany https://lfd.niedersachsen.de

3. Server log files

When you access our website, the hosting provider records technical data in server log files: anonymised IP address, date and time of the request, requested URL, referrer, user agent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability, security and error analysis). Retention: 30 days, then automatic deletion or anonymisation.

4. Hosting, Cloudflare

Our website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Technical delivery is performed from the "fra1" data centre in Frankfurt am Main (EU). A data processing agreement (Art. 28 GDPR) is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses are additionally used. Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

5. Database, Neon

Structured data (e.g. incoming contact form submissions, operational records) is stored in a PostgreSQL database operated by Neon Inc., USA. A data processing agreement is in place with Neon. Neon is certified under the EU-US Data Privacy Framework and additionally uses standard contractual clauses.

6. Contact form, email delivery and CRM; appointment booking, Google Calendar and Google Meet

When you use one of our forms, we collect the data you provide. Depending on the form, this is e.g. your name, email address, phone or WhatsApp number, trade, town and your message. Confirmation and notification emails are sent via Resend, Inc., USA. Legal basis: Art. 6(1)(b) GDPR (initiation/performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient handling of inquiries). Resend is DPF-certified; an Art. 28 data processing agreement is in place.

Retention: until your inquiry is resolved. If a business relationship arises from your inquiry, the commercial and tax-law retention periods apply (§ 257 HGB, § 147 AO; up to 10 years).

Customer management (CRM): we transfer inquiries and bookings into our own customer management system to handle them. It runs on Cloudflare (see section 4); the data is stored in a database of Supabase, Inc., USA. Legal basis: Art. 6(1)(b) GDPR.

AI analysis in the CRM: so that we can assess new inquiries faster, our CRM has some details of your inquiry or booking summarised and categorised automatically by an AI service: name, company, request, budget, timeframe, your message, the page and, if applicable, the appointment. Your phone number and email address are not sent. The provider is Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China; the data is processed and stored in the People’s Republic of China. There is no EU Commission adequacy decision for China. A level of data protection comparable to the EU is not ensured there, and you may not be able to enforce your rights against the provider there. Legal basis: our legitimate interest in handling inquiries quickly (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR), for example by email to info@bigwolfbusiness.com; your inquiry is then handled without the AI analysis.

Appointment booking: you can book a free call through our own booking calendar. We process your name, email address, phone or WhatsApp number, the chosen time, the language of the page and, if you add them, your notes. We need the phone number to reach you if the confirmation email does not arrive. So that it does not go to a mistyped address, before booking we check whether the domain of your email address (the part after the @) can receive email; for this we query the public DNS service of Cloudflare (see section 4). Your full address is not sent. The booking is stored in our database (Neon, see section 5) and in our CRM. Confirmation, reminder and cancellation emails are sent via Resend. You can reschedule or cancel the call yourself with the link in the email. Legal basis: Art. 6(1)(b) GDPR (arranging an appointment at your request).

Google Calendar and Google Meet: for every booked call we create an entry with a Google Meet link in our Google Calendar. Google sends you a calendar invite and receives your name, email address and the time for this. To avoid double bookings, we also check our own busy times with Google. The call takes place via Google Meet, where Google processes the data needed for the video conference (e.g. picture, sound, IP address). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR. Google privacy policy: https://policies.google.com/privacy

7. Google Tag Manager & marketing tools

If you consent to the "Marketing" category in the cookie banner, we load Google Tag Manager (container GTM-5HL35X6F) provided by Google Ireland Limited. Google Tag Manager serves as a container for additional marketing tags (e.g. Google Ads, Meta Pixel) and allows their configurable delivery. We use Google Consent Mode v2: until you grant consent, all consent signals are set to "denied" and no cookie-based data collection takes place. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent).

Meta Conversions API: if you have consented to the "Marketing" category and send a form, our server additionally sends a "Lead" event to Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. It contains your name, email address and phone number where given, each hashed with SHA-256 beforehand (not in plain text), plus your IP address, the browser identifier (user agent), the values of the Meta cookies _fbp and _fbc, the address of the page and which form was used. Purpose: measuring and improving our ads. Without this consent we send nothing to Meta. Legal basis: Art. 6(1)(a) GDPR (consent). Meta may also process data in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

You can withdraw your consent at any time via the "Cookie settings" link in the footer.

8. Web analytics & session replay, Contentsquare and Microsoft Clarity

If you consent to the "Analytics" category in the cookie banner, we load Contentsquare via Google Tag Manager. Provider: Contentsquare SA, 8 rue Saint Fiacre, 75002 Paris, France. Contentsquare helps us understand how visitors use our site, which content gets read, which buttons get clicked, where users drop off.

Data processed: – Mouse, scroll and click behaviour ("pseudonymous interaction data") – Session recordings and aggregated heatmaps – Device and browser information (user agent, screen size, language, approximate city-level location derived from a truncated IP address)

Important: input fields, personal data and sensitive content are automatically masked before recording (data-cs-mask) and are never transmitted to Contentsquare.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent). Contentsquare processes data within the EU; a data processing agreement under Art. 28 GDPR is in place.

Retention: session recordings are kept for up to 13 months in the default configuration, then deleted automatically. Cookies, see our Cookie Policy.

Further information: https://contentsquare.com/privacy-and-security/ Opt out directly with Contentsquare: https://contentsquare.com/optout/

Microsoft Clarity: Also only after you consent to the "Analytics" category, we load Microsoft Clarity via Google Tag Manager. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows us through heatmaps and session recordings how visitors use our pages.

Data processed: mouse, scroll and click behaviour, pages visited, device and browser information and the truncated IP address. Clarity masks form field input by default.

Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Without consent, Clarity is not loaded. You can withdraw consent at any time via "Cookie settings" in the footer.

Third-country transfer: Microsoft may also process data in the USA. Microsoft Corporation is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).

Cookie-free counting on our ad landing pages: Regardless of your choice in the cookie banner, we count page views there, the first interaction with the page, form steps reached (not what you type), whether sending the form worked, taps on buttons such as phone or WhatsApp, and your choice in the cookie banner. Only daily totals per page are stored, split by device type (mobile or desktop) and by whether the visit came from an ad. We set no cookies for this and keep neither your IP address nor any visitor identifier in this count. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring whether our landing pages work).

9. Cookies & local storage

We use cookies and local-storage entries in three categories: Necessary, Analytics and Marketing. A complete overview of every cookie in use, including name, purpose, retention and provider, is in our separate Cookie Policy at /cookies.

In short: • Necessary (no consent required, Art. 6(1)(f) GDPR): "bwb-theme" and "bwb-consent" in local storage, and after you send a form the cookie "bwb_lead" (24 hours, only a random reference), so a call you book right after it is filed with your enquiry. • Analytics (consent required): Contentsquare cookies (_cs_id, _cs_s, _cs_c, _cs_ex). • Marketing (consent required): cookies set by Google Tag Manager and the tags configured through it.

10. Retention periods

We store personal data only as long as necessary to achieve the respective purpose, or as required by statutory retention obligations.

• Server logs: 30 days • Contact form submissions: until resolved; business-relevant correspondence up to 10 years (§ 257 HGB) • Bookings: up to 12 months after the call; if a business relationship follows, the statutory periods apply • Consent record (cookie banner): until withdrawn or until re-prompt (12 months) • Contentsquare session data: up to 13 months

11. Data security

Transmission is encrypted via HTTPS/TLS. We apply technical and organisational measures in line with the state of the art to protect your data against unauthorised access, loss or manipulation.

12. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services. The new privacy policy will then apply to your next visit.