Privacy Notice

Note: This English version is provided for convenience. Only the German version is legally binding (Ausschließlich die deutsche Fassung ist rechtsverbindlich).

1. Controller

The controller within the meaning of Art. 4(7) GDPR for the processing described in this notice is:

Just Growing GmbH, Silberpappelstraße 9, 71364 Winnenden, Germany, Phone: +49 7195 92997700, E-mail: info@webect.de

Managing director: Alexander Schmid (sole authorized representative)

2. Data protection contact

For all questions about data protection, please contact us at info@webect.de or by post at the address above, marked "Data protection".

3. Overview

We process personal data only to the extent necessary to provide a functioning website, to answer your enquiries, to perform contracts and to comply with legal obligations. Our website is a static website. It does not use analytics, tracking or advertising technologies and does not set cookies. In summary:

• When you visit the website, the web server processes technical access data (server log files).
• When you use a contact, demo or trial form or write to us by e-mail, we process the data you provide to handle your request.
• When you or your company are a customer, we process contract and billing data.
• When customers use the Obseria platform, we process their telemetry data on their behalf as a processor.

4. Hosting and server log files

Our website is hosted by [hosting provider, address]. When you access the website, your browser automatically transmits information that the web server stores in log files:

• IP address of the requesting device,
• date and time of the request,
• requested URL,
• referrer URL (the page from which you came),
• user agent (browser type and version, operating system).

We process this data to deliver the website, to ensure its stability and security and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. The log files are automatically deleted after 14 days unless a security incident requires longer retention to clarify it. The hosting provider processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

5. Locally hosted fonts

We use the fonts DM Sans, DM Mono and Merriweather. They are stored on our own server and delivered from there. When you visit the website, no connection is established to Google Fonts or other third-party font services, and no data is transmitted to such providers.

6. No cookies, no tracking

Our website does not set any cookies. We do not use web analytics, tracking pixels, fingerprinting, advertising networks or comparable technologies. Should we introduce such technologies in the future, we will only do so with your prior consent where required by law and will update this notice and our Cookie & Storage Policy beforehand.

7. Local storage in your browser (localStorage)

If you close the announcement banner on our website, your browser stores the entry obs-banner with the value "switch-2026" in its local storage (localStorage). This ensures that the banner is not shown to you again. The entry stays on your device and is never transmitted to us or to third parties. It contains no personal identifiers.

When you first visit, we ask for your privacy settings. Your choice is stored in your browser under obs-consent (localStorage) for 12 months and is not transmitted to us. Analytics and marketing services are only loaded after your consent; currently no such services are used on this website. You can change your choice at any time via "Cookie settings" in the footer.

Storing this information is strictly necessary to provide a function you have explicitly requested (hiding the banner) and is therefore permitted without consent under § 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). To the extent that personal data is processed at all, the legal basis is Art. 6(1)(f) GDPR. You can delete the entry at any time in your browser settings. Details can be found in our Cookie & Storage Policy.

Partner search by postal code, city or location

On our partner page you can search for partners near you by postal code or city. The postal code data (GeoNames, CC BY 4.0) is loaded from our own server; the search and distance calculation take place entirely in your browser, and your input is not transmitted to us. If you click "Use my location", your browser asks for your permission and then determines your position; this position is only used in your browser to calculate the distance and is neither transmitted to us nor stored.

8. Contact, demo and trial forms

Our contact, demo and trial forms are transmitted via the service FormSubmit (formsubmit.co), which forwards the entries to us by e-mail. According to the information on its website, FormSubmit is operated by Devro LABS; the provider does not publish a postal address or the location of its servers. [Full company name and address of the FormSubmit operator, to be confirmed] We therefore cannot rule out that data is processed outside the European Union or the European Economic Area (see section 15).

The following data is processed:

• name,
• e-mail address,
• company,
• your message,
• the page on which you submitted the form,
• the language version of the website.

We use this data exclusively to process your enquiry, to arrange a demo or to set up a trial account. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion of a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries addressed to us. We store the data as long as necessary to handle your request and then delete it, unless statutory retention obligations apply. [Safeguard for the transfer to FormSubmit, e.g. data processing agreement and standard contractual clauses, to be confirmed]

9. Contact by e-mail

If you contact us by e-mail, we process your e-mail address, your name if provided, and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries and Art. 6(1)(f) GDPR for all other enquiries. We delete the data once your request has been dealt with conclusively, unless statutory retention obligations apply, for example for commercial letters.

10. External links and social media links

Our website contains links to our profiles on LinkedIn, X, GitHub and YouTube as well as share buttons. These are plain links. We do not embed social media plugins, widgets or videos. No data is transmitted to these networks when you load our pages. Only when you click a link are you redirected to the respective network, which then processes data under its own responsibility.

11. Applicants

If you apply for a position with us, we process the data you provide (for example contact details, CV, certificates and correspondence) to carry out the application process. The legal basis is § 26 of the German Federal Data Protection Act (BDSG) in conjunction with Art. 88 GDPR and Art. 6(1)(b) GDPR. If your application is unsuccessful, we delete your data six months after the end of the application process, unless you have consented to longer storage for future vacancies (Art. 6(1)(a) GDPR) or we need the data to defend against legal claims. [Applicant management tool, if used: provider and location]

12. Customers and prospects

When we conclude or perform a contract with you or your company, we process contract data such as names and business contact details of contact persons, company data, order and contract data, billing and payment data, and correspondence. The legal basis is Art. 6(1)(b) GDPR. Where we process data of employees of our business customers, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the proper performance of the business relationship. We process data for compliance with tax and commercial law obligations on the basis of Art. 6(1)(c) GDPR.

We may send existing customers information about our own similar services by e-mail (§ 7(3) of the German Act against Unfair Competition, UWG). You can object to this at any time without incurring any costs other than transmission costs at the basic rates.

13. Data processed on the Obseria platform

When customers send telemetry data (such as logs, metrics and traces) to the Obseria platform, the customer is the controller and Obseria acts as processor within the meaning of Art. 28 GDPR. The processing is governed by our Data Processing Agreement (DPA), which is available on our website under "Data Processing Agreement".

The key technical and organisational measures include:

• choice of data residency: EU (Frankfurt, Dublin), UK (London) or the customer's own cloud account,
• automatic masking of personal data in Obseria Pipeline,
• field-level access control and audit logs,
• customer data is never used to train AI models,
• certifications: ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, BSI C5 (EU region) and TISAX.

For the account and user data that we process to manage customer accounts, billing and the security of the platform, Obseria is the controller; section 12 applies accordingly.

14. Recipients

We disclose personal data only where this is necessary for the purposes described above. Recipients may include:

• IT service providers and processors bound by instructions (for example hosting, e-mail delivery, customer support tools and payment processing), see our list of sub-processors,
• FormSubmit for the forwarding of form entries,
• tax advisors and auditors, who are subject to professional secrecy,
• public authorities and courts, where we are legally obliged to do so.

We do not sell personal data.

15. Transfers to third countries

We primarily process personal data within the EU or the EEA. Where data is transferred to a third country, for example to service providers outside the EU or EEA, we do so only if the requirements of Art. 44 et seq. GDPR are met: on the basis of an adequacy decision of the European Commission (Art. 45 GDPR; this applies to the United Kingdom, among others) or appropriate safeguards such as the EU standard contractual clauses (Art. 46(2)(c) GDPR). For FormSubmit, a transfer to a third country cannot be excluded; the safeguard used is: [safeguard, e.g. standard contractual clauses]. You can request a copy of the relevant safeguards from info@webect.de.

16. Retention periods

We store personal data only as long as necessary for the respective purpose. Specific periods are stated in the sections above. In addition, statutory retention obligations apply, in particular under the German Commercial Code (HGB) and the German Fiscal Code (AO): up to six years for commercial letters and up to eight years for accounting vouchers (ten years for other documents relevant to accounting). During these periods, the data is restricted from further processing and then deleted.

17. Your rights

Under the GDPR, you have the following rights with regard to your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object (Art. 21 GDPR, see section 18),
• right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR), where processing is based on consent.

To exercise your rights, simply write to info@webect.de.

18. Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you have the right to object at any time to such processing; we will then no longer use your data for these purposes.

The objection can be made informally, preferably by e-mail to info@webect.de.

19. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

20. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

The provision of personal data is neither legally nor contractually required, except where it is necessary for concluding or performing a contract. Without the data marked as mandatory in the forms, we cannot process your request.

21. Changes to this notice

We may adapt this privacy notice if our website, our services or the legal situation change. The current version is always available on this page.