Data privacy

Last updated: 15 October 2026

1) Controller and general information

1.1 Thank you for visiting our website. Below we explain how we process your personal data when you use this website. Personal data is any information that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

experience5 GmbH
Daniel-Kircher-Str. 5, 40822 Mettmann, Germany
Phone: +49 (2104) 640-9370
Email: team@experience5.de

1.3 For security reasons and to protect the transmission of personal data, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the lock icon in your browser’s address bar.

2) Hosting, server log files and security

2.1 Hosting. This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider processes data on our behalf in accordance with Art. 28 GDPR; a data processing agreement has been concluded. Data is processed in Germany.

2.2 Server log files. When you visit our website, your browser automatically transmits the following data to our server (“server log files”):

  • the page visited
  • date and time of access
  • amount of data transferred
  • the referring website (referrer)
  • browser type and version
  • operating system
  • IP address

This data is technically necessary to display the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of our website. The data is not merged with other data sources. Full IP addresses are deleted by our hosting provider after seven days at the latest; log data in anonymised form may be kept for up to six weeks, unless further retention is required to investigate a specific security incident.

2.3 Security (Wordfence). To protect our website against attacks, we use the security plugin Wordfence, which runs on our own server. It analyses requests to our website, including IP addresses, to detect and block malicious access. This analysis takes place exclusively on our server; no data is transmitted to the provider. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security of our website.

3) Cookies and consent management

3.1 We use cookies and similar technologies. Cookies are small text files that are stored on your device. Some are necessary for the website to function, for example to save your cookie settings (“Functional”). Others are only used with your consent, for example to display embedded videos and our booking tool (“Marketing”).

3.2 Legal basis. Storing or accessing information on your device that is strictly necessary to provide the website is based on § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(f) GDPR. All other cookies and similar technologies are used only with your consent in accordance with § 25(1) TDDDG and Art. 6(1)(a) GDPR.

3.3 Consent management. We use the consent management tool Complianz, which runs on our own server, to obtain and document your consent. It stores your choices in a cookie on your device. You can change or withdraw your consent at any time with effect for the future by clicking the “Manage consent” button at the bottom right of every page.

3.4 You can also configure your browser to notify you when cookies are set, to accept cookies only in certain cases, or to reject them altogether. If you block cookies, some functions of our website may not work.

4) Contacting us and booking appointments

4.1 Email and phone. When you contact us by email or phone, we process the data you provide (e.g. name, email address, company, your message) in order to answer your enquiry. Some buttons on our website, such as “Request quote”, open your own email program with a prepared message; the message is only sent to us when you send it yourself. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries) and, if your enquiry relates to the conclusion of a contract, Art. 6(1)(b) GDPR. We delete the data once your enquiry has been fully dealt with, unless statutory retention obligations apply.

4.2 Appointment booking (Calendly). On some pages you can book an appointment with us via Calendly, a service of Calendly LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. The booking tool is only loaded after you have consented to the “Marketing” category in our cookie banner or by clicking on the placeholder. When you book an appointment, Calendly processes the data you enter (e.g. name, email address, selected time) as well as technical data such as your IP address. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR and § 25(1) TDDDG for loading the tool, and Art. 6(1)(b) GDPR for processing your booking. We have concluded a data processing agreement with Calendly. Calendly LLC is certified under the EU-US Data Privacy Framework. Further information: https://calendly.com/legal/privacy-notice

5) Newsletter

If you subscribe to our newsletter (“The Experience Report”), we process your email address and any other information you provide in order to send you the newsletter. We use the double opt-in procedure: after signing up, you will receive an email asking you to confirm your subscription. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in every newsletter or by sending an email to team@experience5.de. After you unsubscribe, we delete your email address from the mailing list.

We send the newsletter using Enginemailer, a service of Enginemailer Sdn Bhd, Unit 1101B, Level 11, Wisma Prosper, Block B, Kelana Centre Point, No. 3, Jalan SS7/19, Kelana Jaya, 47301 Petaling Jaya, Selangor, Malaysia. The sign-up form on our newsletter page is provided directly by Enginemailer: when you open this page, the form is loaded from Enginemailer’s servers, and Enginemailer receives your IP address and technical information about your browser. The legal basis for loading the form is Art. 6(1)(f) GDPR; our legitimate interest lies in offering a secure and reliable newsletter sign-up. We have concluded a data processing agreement with Enginemailer. As Malaysia is not covered by an adequacy decision of the European Commission, the transfer of your data takes place on the basis of appropriate safeguards in accordance with Art. 46 GDPR.

6) Comments

When you post a comment on our blog, we store and publish your comment together with the name you have chosen and the time of posting. We also store your email address (not published) so that we can contact you if a third party objects to your comment, and your IP address for security reasons, e.g. if a comment contains unlawful content. The legal basis is Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments that are objected to by third parties.

7) Web analytics and tracking

7.1 Rybbit

We use Rybbit as a web analytics service to better understand how visitors use our website and to continuously improve its content, structure and usability.

Rybbit processes usage-related information such as the pages visited, access times, referring websites and technical information about the device and browser used. In addition, we record certain interactions on our website: clicks on email links (e.g. “Request quote”), downloads of our PDF brochures, clicks on booking links and completed appointment bookings via Calendly. Rybbit operates without cookies or similar technologies that store information on your device. IP addresses are processed only in anonymised or truncated form and are not used to identify individual users.

The Rybbit script is loaded from our own domain (www.experience5.de), and the usage data is transmitted to Rybbit via our web server. In this process, your IP address is technically forwarded to Rybbit so that the approximate location (country/region) can be determined; it is then processed only as described above. No cookies are transmitted to Rybbit. Requests to our server are also recorded in the server log files (see section 2).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical analysis of how our website is used, in order to improve it and to ensure its secure and efficient operation.

Rybbit acts as a data processor on our behalf within the meaning of Art. 28 GDPR; a data processing agreement has been concluded. Data is processed exclusively within the European Union / European Economic Area.

You may object to this processing at any time for reasons arising from your particular situation (Art. 21 GDPR, see section 10).

7.2 Sociamonials

Some of our blog articles contain a tracking pixel from Sociamonials, a social media management service provided by Sociamonials, Inc., 5000 Laguna Woods Dr., Elk Grove, CA 95758, USA. We use it to measure how many visitors reach our articles via the posts we publish on social media. When the pixel is loaded, Sociamonials receives your IP address, information about your browser and the page you are visiting.

The pixel is only loaded if you have consented to the “Marketing” category in our cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time by clicking the “Manage consent” button. Data may be processed in the USA; Sociamonials, Inc. is not certified under the EU-US Data Privacy Framework; the transfer takes place on the basis of appropriate safeguards in accordance with Art. 46 GDPR. Further information: https://www.sociamonials.com/privacy.php

8) Embedded content

8.1 YouTube videos. Some pages contain videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube’s enhanced privacy mode (youtube-nocookie.com). Videos are only loaded after you have consented to the “Marketing” category in our cookie banner or by clicking on the video placeholder. When a video is loaded, YouTube receives your IP address and information about the page you are visiting, and may store information on your device. If you are logged in to your Google account, YouTube can link your viewing behaviour to your profile. The legal basis is your consent in accordance with Art. 6(1)(a) GDPR and § 25(1) TDDDG. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy

8.2 Self-hosted videos and fonts. All other videos on our website are stored on our own server. The fonts used on this website are also hosted on our own server; no connection to external font servers is established when you visit our website.

9) Transfers to third countries

Some of the service providers mentioned above are located in, or transfer data to, countries outside the European Union. For the USA, the European Commission has determined that companies certified under the EU-US Data Privacy Framework provide an adequate level of data protection (Art. 45 GDPR). Where a provider is not certified, or is located in a country without an adequacy decision, the transfer takes place on the basis of appropriate safeguards in accordance with Art. 46 GDPR, such as the EU Standard Contractual Clauses.

10) Your rights

Under the GDPR, you have the following rights with regard to your personal data:

  • Access (Art. 15 GDPR): You can request information about the personal data we process about you.
  • Rectification (Art. 16 GDPR): You can request the correction of inaccurate or incomplete data.
  • Erasure (Art. 17 GDPR): You can request the deletion of your data, provided there is no legal obligation or overriding reason to retain it.
  • Restriction of processing (Art. 18 GDPR): You can request that we restrict the processing of your data, e.g. while the accuracy of your data is being verified.
  • Data portability (Art. 20 GDPR): You can request to receive the data you have provided to us in a structured, commonly used and machine-readable format.
  • Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
  • Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you have the right to object to such processing at any time. In this case, we will no longer process your data for these purposes.

To exercise your rights, please contact us at team@experience5.de.

11) Storage period

Unless a specific storage period is stated above, we store personal data only for as long as necessary for the respective purpose. Where statutory retention obligations apply (e.g. under commercial or tax law), the data is stored until the end of the retention period and then deleted.

12) Changes to this privacy policy

We may update this privacy policy to reflect changes to our website or to legal requirements. The version published on this page applies.

Scroll to Top