Privacy Policy

1. General Information

Protecting personal data is important to us. In this Privacy Policy, we explain which personal data we process in connection with our website, online shop, customer accounts and software products, for which purposes this processing takes place, on which legal basis it is carried out and which rights data subjects have. Our services are aimed both at consumers within the meaning of Section 13 of the German Civil Code (BGB) and at businesses within the meaning of Section 14 BGB, legal entities under public law and special funds under public law. When using our website, online shop, customer accounts and software products, personal data relating in particular to customers, prospective customers, website visitors, contact persons, sole traders, employees of business customers and other users may be processed.

2. Controller

The controller responsible for data processing is: Witte Marketing Owner: Werner Witte Zangberger Str. 2 84539 Ampfing Germany Email: info@witte.marketing Telephone: 08636 325499

3. Definitions

This Privacy Policy uses the terms defined in the General Data Protection Regulation (GDPR), in particular “personal data”, “processing”, “controller”, “processor”, “consent” and “data subject”. Personal data means any information relating to an identified or identifiable natural person.

4. Legal Bases for Processing

We process personal data in particular on the basis of the following legal provisions:

Art. 6(1)(a) GDPR, where consent has been obtained for processing;
Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
Art. 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation;
Art. 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or those of a third party and those interests are not overridden by the interests or fundamental rights of the data subject.

Where information is stored on or accessed from a user’s terminal device, the provisions of the German Telecommunications Digital Services Data Protection Act (TDDDG) also apply.

5. Accessing the Website and Server Log Files

When our website is accessed, technical data is processed automatically by the web server. This may include in particular:

IP address;
date and time of access;
page or file accessed;
amount of data transferred;
referrer URL;
browser type and browser version;
operating system used;
hostname of the accessing device;
HTTP status code.

The processing takes place in order to provide the website technically, ensure system security, detect attacks or misuse and ensure the stability and proper functioning of our systems. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website and online shop securely, reliably and without errors. Log data is stored only for as long as necessary for the purposes stated above, unless longer retention is required due to a specific security incident or for the establishment, exercise or defence of legal claims.

6. Hosting and Technical Service Providers

We use hosting and IT service providers to make our website, online shop, customer account, licence systems and other technical functions available. Personal data may be processed on the systems of these service providers. Processing takes place in particular for the provision of

the website;
the online shop;
the customer account;
the checkout;
payment integrations;
licence management;
email communication;
technical security.

The legal bases are Art. 6(1)(b) GDPR where processing is necessary for the performance of a contract, Art. 6(1)(c) GDPR where legal obligations are concerned, and Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure and reliable operation of our systems. Where service providers process personal data exclusively on our behalf, this is carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR.

7. Cookies, Local Storage and Similar Technologies

Our website uses cookies, local storage technologies and, where applicable, comparable technologies. Information may be stored on the user’s terminal device or information may be accessed from that device.

Technically Necessary Technologies

Technically necessary cookies and comparable technologies may be used in particular for:

basket and checkout;
customer account and login;
security functions;
form functions;
language settings;
technical display;
storage of privacy and consent settings.

Where storage or access is strictly necessary in order to provide a digital service expressly requested by the user, this is carried out on the basis of Section 25(2) TDDDG. Subsequent processing of personal data is carried out, depending on the respective purpose, in particular on the basis of Art. 6(1)(b) or (f) GDPR.

Technologies Requiring Consent

Non-essential cookies or comparable technologies, in particular for analytics, marketing or certain external services, are used only after the required consent has been given. In such cases, the legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Consent that has been given may be withdrawn at any time with effect for the future.

8. Customer Account

A customer account may be required for orders and the use of our digital products. Within the customer account, we may process in particular the following data:

first and last name;
company or organisation, if provided;
billing address;
email address;
customer number or internal customer identifier;
orders;
invoices;
downloads;
licence information;
login and status data.

Processing takes place for the creation and administration of the customer account, processing of orders, provision of digital products, licence management, invoicing and communication with the customer. The legal basis is Art. 6(1)(b) GDPR. Where statutory retention obligations apply, processing is additionally based on Art. 6(1)(c) GDPR.

9. Orders in the Online Shop

If you place an order through our online shop, we process the personal data required to fulfil the order. This may include in particular:

first and last name;
company or organisation, if provided;
billing address;
country;
email address;
VAT identification number, if provided;
products ordered;
price and tax information;
payment method;
order number;
invoice number;
technical order and status data.

Processing takes place to accept and fulfil the order, process payment, provide licence keys and downloads, issue invoices and communicate with customers. The legal basis is Art. 6(1)(b) GDPR. Where data must be processed or retained due to tax, commercial or other statutory obligations, processing is additionally based on Art. 6(1)(c) GDPR.

10. Company Data, VAT ID and Tax Verification

If you place an order as a business or provide company details, we may process additional information in order to handle the order correctly for tax purposes. This may include in particular:

company or organisation;
billing address;
country;
VAT identification number;
verification status of the VAT identification number;
time of verification;
order and invoice data;
tax-relevant status information.

Providing a VAT identification number is not automatically a prerequisite for being regarded as a business. Processing takes place in particular

to ensure the correct tax treatment of the order;
for invoicing;
to verify whether the requirements for any applicable VAT treatment are met;
to comply with tax-related documentation and retention obligations;
to prevent misuse or incorrect tax information.

Depending on the respective processing operation, the legal bases are Art. 6(1)(b), (c) and (f) GDPR. Our legitimate interest lies in particular in preventing misuse and ensuring proper tax handling.

11. Payment Processing

We use external payment service providers to process payments. The payment methods currently available are displayed during checkout. Depending on the selected payment method, personal data may be transmitted to the respective payment service provider. The data processed may include in particular:

name;
email address;
billing address;
order number;
payment amount;
currency;
payment method;
payment status;
transaction identifier;
technical payment data.

Processing takes place to execute and allocate the payment, confirm payment, prevent fraud and comply with accounting and statutory obligations. Depending on the respective processing operation, the legal bases are Art. 6(1)(b), (c) and (f) GDPR.

Mollie

The following payment service provider may be used for payment processing: Mollie B.V. Keizersgracht 126 1015 CW Amsterdam The Netherlands If a payment method provided via Mollie is selected, the data required to process the payment is transmitted to Mollie. Mollie may process personal data under its own responsibility for data protection purposes in connection with its payment services.

PayPal

If PayPal is offered and selected as a payment method, the data required to process the payment may be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A. 22–24 Boulevard Royal L-2449 Luxembourg PayPal also processes personal data under its own responsibility for data protection purposes in connection with its payment services. As a rule, we do not receive complete payment data such as full credit card numbers or login credentials for payment services where these are processed directly by the respective payment service provider.

12. Invoices, Accounting and Statutory Tax Retention

After a successful order, we issue an invoice. Invoices may be provided electronically, in particular

by email;
in the customer account;
as a download;
in a legally prescribed electronic invoice format.

Where technically provided, our invoices may also contain structured invoice data, for example in ZUGFeRD format. In connection with invoicing and accounting, the following data may be processed in particular:

first and last name;
company or organisation, if provided;
billing address;
email address;
VAT ID, if provided;
order and service data;
price and tax information;
invoice number;
payment status;
booking and transaction data.

Processing takes place for the performance of the contract, invoicing, accounting, tax documentation and compliance with statutory retention obligations. The legal bases are Art. 6(1)(b) and (c) GDPR.

13. Licence Server, Licence Verification, Updates and Downloads

Technical and personal data may be processed for the provision and administration of our software products, licence keys, activations, downloads, updates and support entitlements. This may include in particular:

licence key or licence identifier;
domain or website URL;
product and licence model;
activation status;
time of activation or licence verification;
IP address;
plugin version;
WordPress version;
WooCommerce version;
PHP version;
technical status information;
error or update information.

Processing takes place in particular

to activate and manage licence services;
to verify the purchased scope of activation and services;
to provide updates and downloads;
to allocate support entitlements;
to prevent misuse;
to analyse errors;
to ensure technical functionality.

The legal bases are Art. 6(1)(b) and (f) GDPR. Our legitimate interest lies in particular in secure and contract-compliant licence management, prevention of misuse and the technical provision of our software products.

14. Feedback When Deactivating a Plugin

Some WordPress plugins provided by us may display an optional feedback dialogue when the plugin is deactivated. Providing feedback is voluntary. Data is transmitted only if an authorised user actively submits the feedback. The following information may in particular be transmitted via the feedback form:

plugin slug;
plugin name;
plugin version;
edition or product variant;
selected reason for deactivation;
optional free-text message;
language environment / locale;
time of submission.

Processing takes place to evaluate voluntary feedback, improve our plugins, analyse errors and further develop our products. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in improving, troubleshooting and user-oriented further development of our software products. No order, customer, withdrawal, invoice or payment data from the respective WooCommerce shop is transmitted via this feedback form unless expressly described otherwise in the relevant plugin. When the feedback endpoint is accessed, server log data may be processed for technical reasons, in particular the IP address, date and time, endpoint accessed and HTTP status code. This processing takes place for technical provision, security, error analysis and prevention of misuse on the basis of Art. 6(1)(f) GDPR.

15. Contact and Support

If you contact us by email, contact form, support request or by another means, we process the data you provide in order to deal with your enquiry. This may include in particular:

name;
company or organisation, if provided;
email address;
telephone number, if provided;
customer number;
order number;
licence key or licence identifier;
message content;
technical information;
attachments or screenshots, if provided.

Processing takes place to deal with your enquiry, communicate with you, analyse technical errors, provide customer support and document the matter. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to an existing or potential contract. Otherwise, processing takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in properly dealing with and documenting enquiries.

16. Transactional Emails and System Notifications

We send transaction-related emails and system notifications. These may include in particular:

order confirmations;
payment information;
invoice notifications;
licence information;
download information;
password and account notifications;
security and two-factor authentication messages;
other system messages required for the performance of the contract.

Processing takes place for the performance of the contract, provision of the customer account and compliance with statutory or contractual information obligations. Depending on the respective process, the legal bases are Art. 6(1)(b), (c) and (f) GDPR.

17. Email Service Providers

Email and delivery service providers may be used for the technical sending of emails. The following data may be processed in particular:

email address;
name;
order or account information;
technical delivery data;
delivery status;
content of the respective message.

Processing takes place to ensure reliable email delivery, analyse errors and document email dispatch. Depending on the type of message, the legal bases are Art. 6(1)(b) and (f) GDPR. Where a service provider processes personal data exclusively on our behalf, this is carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR.

18. Newsletter and Promotional Communication

As a rule, we send newsletters and other promotional emails only where consent has been given or where another legal permission applies.

Newsletter with Consent

If you subscribe to our newsletter, the following data may be processed in particular:

email address;
name, if provided;
company, if provided;
time of registration;
IP address;
proof of consent;
newsletter subscription status.

Processing is based on Art. 6(1)(a) GDPR. Consent that has been given may be withdrawn at any time with effect for the future, in particular via the unsubscribe link in our newsletter emails.

Advertising to Existing Customers

Where the statutory requirements are met, we may use a customer’s email address obtained in connection with a sale in order to provide information about our own similar products or services. This is done only where the statutory requirements are met and the customer has not objected to the use. When the email address is collected and each time it is used for this purpose, the customer is informed that they may object to the use of their email address for advertising purposes at any time. No costs other than transmission costs at the basic rates are incurred for such an objection.

19. Security and Prevention of Misuse

We also process personal data to ensure the security of our website, online shop, customer accounts, licence systems and other technical infrastructure. This may include in particular:

IP addresses;
technical access data;
login data;
error messages;
security events;
technical status information.

Processing takes place in particular to detect, prevent and investigate

misuse;
attacks;
attempted fraud;
unauthorised access;
licence misuse;
technical faults.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security of our systems, protection of our customers, prevention of misuse and ensuring proper operation.

20. Recipients of Personal Data

For the purposes described in this Privacy Policy, personal data may in particular be transmitted to the following categories of recipients:

hosting and IT service providers;
payment service providers;
email and communications service providers;
accounting and tax service providers;
support and technical service providers;
legal and tax advisers;
authorities, courts or other public bodies where there is a legal obligation to do so.

Personal data is disclosed only where this is necessary for the purposes stated, where a legal obligation applies, where consent has been given or where another legal basis under data protection law exists.

21. Transfers to Third Countries

Personal data is transferred to countries outside the European Union or the European Economic Area only where the requirements under data protection law are met. A transfer to a third country may take place in particular where a service provider used by us is established outside the European Union or European Economic Area, or where data is processed there. Where necessary, such a transfer takes place in particular on the basis of

an adequacy decision by the European Commission;
appropriate safeguards such as the European Commission’s Standard Contractual Clauses; or
another legal basis permitted under the GDPR.

22. Retention Period

As a rule, we store personal data only for as long as necessary for the respective processing purpose or for as long as statutory retention obligations apply. Order, contract, invoice and accounting data is stored for the duration of the applicable statutory commercial and tax retention periods. Customer account data is stored for as long as the customer account exists or the data is required for contract processing, licence management, support, evidential purposes or statutory obligations. Support and communication data is stored for as long as necessary to deal with the enquiry, provide customer support, document the matter or protect legitimate interests. Server log files and technical security data are stored only for as long as necessary for technical security, error analysis and prevention of misuse. In the event of specific security incidents, data may be stored for longer where necessary for investigation or legal enforcement. Records of consent may be stored for as long as necessary to demonstrate that consent was properly given and to defend or enforce legal claims. Once the respective processing purpose no longer applies, personal data is deleted or blocked unless statutory or other permissible grounds require further storage.

23. Matomo

We use the open-source web analytics software Matomo on our website in order to analyse the use of our website statistically and to further develop our services from a technical, content and usability perspective. We operate Matomo via our own Matomo instance at analyse.witte.marketing. The analytics data collected using Matomo is not disclosed to Matomo or other providers for advertising purposes. We have configured Matomo with privacy in mind. In particular, it is used without tracking cookies. IP addresses are anonymised before storage by shortening them by at least two bytes. In addition, the “Do Not Track” signal transmitted by the browser is respected. The following information may be processed in connection with the use of Matomo:

pages and content accessed;
time and duration of page views;
referrer or previously visited page;
browser used and browser version;
operating system;
device type;
screen resolution and technical device information;
approximate geographical origin or region;
interactions and links accessed;
technical usage and access information.

Processing takes place for the statistical analysis of the use of our website and for the technical, content-related and user-friendly optimisation of our services. The legal basis for processing personal data is Art. 6(1)(f) GDPR. Our legitimate interest lies in analysing and improving our online services. Matomo is operated exclusively via our own Matomo instance. The analytics data collected is not combined with data from other websites and is not used for personalised advertising or to create cross-site user profiles.

Objection to Tracking by Matomo

You may object to the recording of your visits by Matomo at any time with effect for the future. You can view your current setting below and change it at any time. If you disable Matomo analytics, a technically necessary opt-out cookie is stored on your device. This allows Matomo to recognise that your browser should no longer be included in web analytics during future visits. Please note that this opt-out setting applies to the browser currently being used. If you use another browser or another device, or if you delete stored cookies or website data, you may need to opt out again.

24. Rights of Data Subjects

Subject to the statutory requirements, data subjects have in particular the following rights:

right of access under Art. 15 GDPR;
right to rectification under Art. 16 GDPR;
right to erasure under Art. 17 GDPR;
right to restriction of processing under Art. 18 GDPR;
right to data portability under Art. 20 GDPR;
right to object under Art. 21 GDPR;
right to withdraw consent under Art. 7(3) GDPR;
right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR.

To exercise your rights, you may contact us at any time: Email: info@witte.marketing

25. Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent prior to its withdrawal remains unaffected. Where consent was given via our cookie or privacy settings, it can generally also be changed or withdrawn there.

26. Right to Object

Objection to Processing Based on Legitimate Interests

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right, in accordance with Art. 21 GDPR, to object to such processing at any time on grounds relating to your particular situation.

Objection to Direct Marketing

Where personal data is processed for direct marketing purposes, you have the right at any time to object to the processing of your personal data for such marketing purposes. Following your objection, your personal data will no longer be processed for these purposes.

27. Requirement to Provide Personal Data

The provision of certain personal data is required in order to enter into or perform a contract. Without this data, we may in particular be unable to carry out, or may be unable to carry out fully,

an order;
payment processing;
provision of a licence;
invoicing;
operation of a customer account; or
certain support services.

In addition, personal data must be processed where this is required by statutory obligations, in particular in connection with invoice, accounting and tax data.

28. Automated Decision-Making

We do not carry out decision-making based solely on automated processing, including profiling within the meaning of Art. 22 GDPR, which produces legal effects concerning you or similarly significantly affects you.

29. Currency and Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy if

legal requirements;
technical functions;
service providers used;
our products; or
our data processing activities

change. The version published on this website at the relevant time applies.

Last updated: August 2026