Welf GmbH
Privacy policy.
This notice explains the personal data processed through Welf GmbH's website, the purposes of processing and your rights.
Operating details under review
Welf GmbH’s contact details are included. Hosting, provider regions, retention periods and any appointed data protection officer still require confirmation against the operating setup.
Controller and privacy contact
The controller is Welf GmbH, Colonnaden 5, 20354 Hamburg, Germany, represented by managing director Reza Esfahanian.
For privacy questions and requests to exercise your rights, contact us using the details below.
Website delivery and security
Visiting the site transmits an IP address and the connection information required to deliver the page. Depending on the hosting configuration, access or security logs may contain the request time, URL, HTTP status, browser information and referring page.
We process this information to deliver the website, resolve errors and prevent abuse. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in a secure and reliable website.
To be completed: the hosting provider and contracting entity, processing locations, actual log fields and deletion periods. The final hosting and logging configuration must be checked before publication.
Contact by form, email or telephone
The form processes your name, company, email address and message, together with the selected language and a technical request identifier. These details are used to handle your inquiry, reply and confirm submission. Please do not submit especially sensitive information or confidential client data through the form.
Contacting us is voluntary. Fields marked required are needed to process a form submission; the form cannot be submitted without them. An inquiry does not subscribe you to a newsletter or give marketing consent.
For inquiries about a contract with you or steps you request before entering a contract, we process data under Article 6(1)(b) GDPR. For company representatives and other business inquiries, we rely on Article 6(1)(f) GDPR and our legitimate interest in handling and answering those inquiries. If you contact us by email or telephone, we use the contact details and information you provide for the same purpose.
Email delivery through Resend
When live delivery is enabled, the system sends your inquiry to Resend for delivery to Welf's configured mailbox. A confirmation containing a reference is sent to your email address. It does not repeat your message, submitted name or company.
Resend and the involved email providers process email addresses, message content and delivery information. The application does not separately store your message in Redis or write it to application logs. Error logs may include technical request identifiers and error categories.
To be confirmed: the Resend contracting entity, mailbox provider, processing agreements, locations, email deletion periods and technical log retention.
Abuse prevention and reliable delivery
When the online form and its security check are enabled, it uses Cloudflare Turnstile. Technical browser and connection information is sent to Cloudflare to detect automated or abusive submissions, and the resulting token is checked on the server. Cloudflare’s notice explains provider-side processing. You can alternatively contact us by email or telephone.
Upstash Redis supports submission limits, recognition of accepted requests and handling of delivery events. Data includes cryptographically protected, pseudonymous derivatives of email addresses or inquiries, technical identifiers and timing information. Pseudonymous data is not automatically anonymous.
The proposed basis for these security and reliability functions is Article 6(1)(f) GDPR. The balancing assessment, necessity, provider roles, device access and any required consent implementation must be confirmed before live operation.
Retention
Data is processed for the relevant purpose and then deleted unless further retention is necessary. Different systems have different retention periods.
- Redis submission receipts
- Seven days after storage. Records contain technical identifiers, a pseudonymous fingerprint and delivery identifiers, not the message body.
- Redis delivery events
- 30 days after storage. Records contain event type, email identifier and event time; no recipient address or subject.
- Submission limits
- The application uses one-hour checking windows. Confirm the actual deletion timing of the underlying provider counters before publication.
- Emails and business correspondence
- To be set: a concrete deletion policy for closed inquiries and applicable statutory retention periods. Redis retention does not apply to mailboxes or Resend.
- Hosting and error logs
- To be confirmed: provider, configuration and actual deletion periods.
Recipients and international transfers
Access is available to the Welf personnel handling the inquiry and the service providers used for the relevant functions. Hosting, email and security providers may use subprocessors.
Processing outside the European Economic Area depends on the contracted provider regions and subprocessors. The actual recipients, countries and applicable transfer mechanisms under Articles 44 onwards GDPR must be documented. No exclusive EU processing or particular certification is promised.
You can request information about the transfer safeguards used and a copy of the relevant safeguards at [email protected].
Cookies, local resources and measurement
The consent dialog lets you choose analytics (Google Analytics and Ahrefs) and marketing (Meta Pixel). Both categories are off by default. Optional processing relies on your consent under Article 6(1)(a) GDPR and, where information is stored or accessed on your device, section 25(1) TDDDG.
Google Tag Manager (Google Ireland Limited) loads before you choose, to manage tags. This sends Google technical connection data, including your IP address. Analytics and marketing tags remain blocked without the respective permission. For technical tag management, we rely on our legitimate interest in managing the website under Article 6(1)(f) GDPR. Fonts and images are served locally. See the cookie and technology notice for service details and choices.
Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time with effect for the future.
You may object to processing based on legitimate interests for reasons relating to your particular situation. You have an unconditional right to object to direct marketing. This contact function does not subscribe you to direct marketing.
Send your request to [email protected] or our postal address above. We normally respond within one month of receipt. Where permitted by law, complex or numerous requests may require an extension; we will inform you within the first month. You can also complain to a data protection authority, particularly where you habitually reside, work or believe an infringement occurred.
Automated decisions and scope
The contact form does not make solely automated decisions about you that have legal or similarly significant effects. Technical validation may limit submission when errors or abuse are detected.
This notice covers the website and its contact function. Processing client data in subsequent AI projects is addressed separately for the relevant engagement.