— Privacy
Data Protection
We take the protection of your personal data seriously. This notice explains what information we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR).
Controller
Workplace Wellbeing Solutionsc/o Klemke Services
Senckenberganlage 10–12
60325 Frankfurt
Germany
Contact: hello@workplacewellbeingsolutions.de
Responsible for data protection: Jacqueline Klemke
What data we collect and why
When you use our contact form, we collect your name, email address, company name (optional), and message. We process this data solely to respond to your inquiry and, where applicable, to prepare a proposal or consultation.
Client accounts. Staff of client organisations we invite receive an account (email address and password). If a signed-in client chooses to save a Wellbeing Maturity Check result, we store the overall score, maturity level, scores per area and an optional label, linked to their organisation. Individual answers are never stored. Only members of that organisation can see its results. Anonymous visitors' answers are never stored.
Visitor statistics. We count page views and actions such as starting or completing the wellbeing maturity check. The section below explains exactly what is recorded, what is not, and how it stays anonymous.
How visits and maturity check results are counted anonymously
We measure whether this site is useful: how many people read a page, click a button, start the wellbeing maturity check, finish it, or ask for their summary by email. We do this without building a profile of you. Our own counting sets no cookies, stores no IP addresses, and uses no device fingerprinting.
| What happens | What we record | What we never record |
|---|---|---|
| You view a page | Which page, when, and the domain you came from | Your IP address, device details, name or email address |
| You click a button or link | Which button, on which page, when | Any of the personal details listed opposite |
| You start or complete the maturity check | A count, and whether the visit that started a check also finished it | Your answers, your scores, your result |
| You ask for your results by email | A count of requests only | Your email address, your answers, your scores |
Your answers stay on your device
The maturity check runs in your browser. Your answers, your overall score, the pillar chart, the recommendations, the PDF and the CSV file are all produced on your own device, and nothing about your answers or your score is stored by us. We record only that a check was started, and separately that a check was completed, without knowing who took it or what it said. If you ask for a summary email, your scores are sent once to produce that message and are then discarded.
The one reference we use, and only with your consent
If you accept analytics cookies, this site puts a random reference in your browser tab so that a check which was started can be recognised as the same check when it is completed. That is all it does. It is generated by this site, contains nothing about you, is deleted automatically when you close the tab, and cannot be used to follow you across days or devices. If you do not accept analytics cookies, no reference is attached at all and every visit is a plain, unrepeatable count.
Where you came from
If you arrived from another website, we keep only the domain you came from (for example linkedin.com) rather than the full web address, unless you have accepted analytics cookies. We do not record which page you were reading beforehand.
Only real visits are counted
Counting only runs on the live site at workplacewellbeingsolutions.de. Preview versions of the site and our own testing record nothing, so the figures we report are real visitors rather than internal traffic.
Summary emails
If you ask for your results by email, your address is used to send that one message and is then discarded. It is not added to a mailing list and is never stored alongside your answers. To stop the form being abused, a short-lived, unreadable reference (a salted hash) of the address and the connection is kept in our anti-spam table, which limits requests to three per hour. That reference cannot be turned back into your address.
Saving a result is optional, and only for client accounts
Staff of a client organisation we have invited can sign in and choose to save a result to their organisation's account. Only the overall score, the maturity level, the six pillar scores and an optional label are kept, and only members of that organisation can see them. Anonymous visitors are never asked, and nothing is saved for them.
How long counts are kept
Visit and check counts are stored in our EU-hosted database and deleted no later than 12 months after they are recorded. A LinkedIn ad reference attached to an event is deleted 365 days after it was captured. We keep an internal audit of these deletions, so the policy is checked rather than simply promised.
Legal basis and your choices
Anonymous counting is based on our legitimate interest in understanding and improving this site (Article 6(1)(f) GDPR). Anything that stores something in your browser or attaches an identifier, such as the tab reference or the LinkedIn ad reference, is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can change or withdraw that choice at any time in “Cookie settings” in the footer. Withdrawing it stops identifiers being stored or sent, and the anonymous counts continue.
Legal basis
Processing is based on Article 6(1)(b) GDPR (pre-contractual measures at your request) and Article 6(1)(f) GDPR (legitimate interest in communicating with prospective clients). We do not use your data for automated decision-making or profiling.
Storage and retention
We retain your contact data for as long as necessary to handle your inquiry and for any subsequent business relationship, up to a maximum of three years, unless statutory retention obligations require longer storage.
Third parties and hosting
We do not sell or share your personal data with third parties for marketing purposes. Your data is stored and processed via our secure cloud infrastructure provider (Lovable Cloud) solely for the purpose of delivering our services to you.
Cookies and similar technologies
We use only what is strictly necessary to run this site by default. Non-essential cookies (analytics, marketing) are loaded only after you give consent via the cookie banner. You can change or withdraw your choice anytime via “Cookie settings” in the footer. The table below lists every cookie and similar storage item this site may set, its purpose, retention period and source.
| Name | Category | Purpose | Retention | Provider |
|---|---|---|---|---|
| wws-cookie-consent-v1 | Strictly necessary | Stores your cookie preferences so the banner is not shown again. | 12 months (local storage) | First party (this site) |
| sb-<project>-auth-token | Strictly necessary | Set only if you authenticate (e.g. for admin access). Maintains your secure session. | Session / up to 7 days (local storage) | Lovable Cloud (Supabase, EU) |
| _ga, _ga_* | Analytics (consent required) | Distinguishes users to measure site usage. Loaded only after consent. | Up to 13 months | Google Analytics, Google Ireland Ltd. |
| li_at, bcookie, lidc | Marketing (consent required) | Set if LinkedIn Insight Tag is loaded to attribute campaign visits. Loaded only after consent. | Session – 2 years | LinkedIn Ireland Unlimited Co. |
| wws-li-adsid-v1 | Marketing (consent required) | Stores the LinkedIn ad click identifier (li_adsid / li_fat_id) from the URL as a first-party value, so we can tell which LinkedIn campaign led to an enquiry. Written only after marketing consent and deleted if you withdraw it. | 90 days (local storage) | First party (this site) |
Analytics and marketing items are listed for transparency and are not active unless you opt in. If we add or change any cookie, this list and the consent banner will be updated accordingly.
LinkedIn ad attribution (li_adsid)
When you reach this site by clicking one of our LinkedIn ads, LinkedIn adds an identifier to the link address, named li_adsid (sometimes li_fat_id). It is a random campaign click reference created by LinkedIn. It does not contain your name, email address, job title or LinkedIn profile, and we cannot use it to identify you.
- Purpose: to understand which LinkedIn campaign brought a visitor to the site and whether that visit led to a meaningful action, such as starting the wellbeing maturity check or sending an enquiry. This is campaign measurement only: we do not use it for profiling, automated decision-making or advertising to you personally.
- Consent: the identifier is only read and stored if you accept marketing cookies. Without that consent it is ignored entirely, and if you later withdraw consent via “Cookie settings” the stored value is deleted from your browser immediately and no longer sent with any event.
- Where it is stored: as a first-party value in your browser's local storage under wws-li-adsid-v1, and alongside consented analytics events in our own database in the EU. It is not shared with LinkedIn or any other third party.
- Retention: the value stored in your browser expires after 90 days from the ad click, after which it is discarded and a new click starts a fresh 90-day window. The identifier recorded with analytics events in our database is kept for a maximum of 12 months and then deleted.
- Legal basis: your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG, which you can withdraw at any time with effect for the future.
You can clear the identifier yourself at any time by rejecting marketing cookies, or by clearing site data for this domain in your browser settings.
Frequently asked questions about your data
Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to object to processing and to lodge a complaint with a supervisory authority.
To exercise your rights, please contact us at hello@workplacewellbeingsolutions.de.
Data security
We apply appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure.
Right to complain
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. In Hesse, this is the Hessian Data Protection Commissioner (Hessischer Datenschutzbeauftragter).