Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

   ReWorth Blocks UG (haftungsbeschränkt)

   Grillparzerstraße 43

   81675 Munich, Germany

Represented by Managing Director Esther Heyse

   Email: info@reworthblocks.com

   Phone: +49 152 34118970

In our assessment, a Data Protection Officer is currently not legally required to be appointed, as the requirements of Section 38 BDSG (including, as a general rule, at least 20 persons who are continuously engaged in the automated processing of personal data) are not met. If you have any questions regarding data protection, please contact us directly using the email address stated above.

 

2. General Information on Data Processing

As a general rule, we process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. Personal data is generally processed only with the consent of the users or on another legal basis, in particular where the processing is necessary for the performance of a contract or for pre-contractual measures (Art. 6(1)(b) GDPR), or insofar as it is necessary for the purposes of legitimate interests and the interests, fundamental rights and freedoms of the data subject do not override those interests (Art. 6(1)(f) GDPR).

 

3. Provision of the Website and Creation of Server Log Files

Each time our website is accessed, our system automatically collects data and information from the accessing device. This data is stored in the log files of our hosting provider. The following data is collected:

• IP address of the accessing device

• Date and time of access

• Name and URL of the accessed file

• Website from which access is made (referrer URL)

• Browser and operating system used

This data is processed exclusively to ensure the trouble-free operation of the website as well as the security of our information technology systems. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest arises from the purposes of data collection stated above. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected, generally after no more than 14 days.

Our website is hosted by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel (“Wix”), and operated using the Wix website builder. In this context, Wix processes technical data (including IP addresses and log files) as our processor or as an independent controller, insofar as this is necessary for the secure and stable operation of the platform. The European Commission has adopted an adequacy decision for Israel pursuant to Art. 45 GDPR; data may therefore be transferred there without additional safeguards. Further information: Wix Privacy Policy at www.wix.com/about/privacy.

 

4. Cookies

Our website currently uses only technically necessary cookies that are set by our website builder provider Wix and are required for the operation, security and core functionality of the website. These cookies do not collect or process personal data for marketing or analytics purposes. The legal basis is Section 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR; consent is not required for this category of cookies. A separate provision applies to the separate booking page of our appointment booking tool BookIvy; see Section 8.

 

   Cookie: svSession

   Purpose: Recognition of website visits, security and core functionality of the website

   Duration: 12 months

   Provider: Wix.com Ltd.

 

   Cookie: wixSession

   Purpose: Security, stability and core functionality of the website

   Duration: 12 months

   Provider: Wix.com Ltd.

 

   Cookie: XSRF-TOKEN

   Purpose: Protection against fraudulent form and API requests

   Duration: Session

   Provider: Wix.com Ltd.

 

   Cookie: bSession

   Purpose: Measurement of technical system effectiveness

   Duration: 24 hours

   Provider: Wix.com Ltd.

 

   Cookie: fedops.logger.sessionId

   Purpose: Detection and tracking of system errors for troubleshooting purposes

   Duration: 12 months

   Provider: Wix.com Ltd.

 

   Cookie: TS*

   Purpose: Detection of attacks and abusive access

   Duration: Session

   Provider: Wix.com Ltd.

 

As soon as we use additional cookies or technologies that are not technically necessary (e.g. audience measurement or marketing tools), we will obtain explicit consent in advance via a cookie consent banner in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG and update this Privacy Policy accordingly.

Cookie Consent Banner

When you visit our website, a cookie consent banner (Usercentrics for Wix) gives you the option to consent to or reject the use of cookies beyond those that are technically necessary, or to consent separately to individual categories (e.g., functional, analytics, marketing). Until you make your decision, only technically necessary cookies and scripts are loaded; non-essential cookies and scripts are activated only after you give your consent. Your decision is stored on your device via a cookie from the consent tool so that you are not asked again on your next visit. You can change or revoke your selection at any time via the corresponding link or button in the banner or in the cookie settings on our website. The legal basis for non-essential cookies is your consent pursuant to Art. 6(1)(a) GDPR, § 25(1) TDDDG; consent may be revoked at any time with future effect (Art. 7(3) GDPR).

To the best of our current knowledge, as of the date of this statement, no additional analytics, marketing, or tracking tools (e.g., Google Analytics, Meta Pixel) are enabled beyond the banner; therefore, only the technically necessary cookies listed above are currently being set. As soon as we begin using additional cookies or technologies that are not technically necessary, they will be enabled exclusively with your consent via the banner, and this statement will be updated to include the respective providers, purposes, and retention periods.

 

5. Contact Form and Email Contact

A contact form is available on our website through which you can contact us. The following data is collected:

• First name

• Last name

• Email address

• Your message (free text)

This data is processed for the purpose of handling and responding to your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry serves to initiate a contract; otherwise, Art. 6(1)(f) GDPR applies (legitimate interest in responding to incoming enquiries). If you contact us by email, the same applies accordingly to the personal data communicated in this context.

The data is deleted as soon as it is no longer required for the purpose for which it was collected; in the case of data from the contact form, this is the case when the respective conversation with you has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter concerned has been conclusively resolved, but no later than after 12 months.

 

6. Applications

You can apply to us by email via our careers page. As part of the application process, we process the personal data you provide to us, in particular contact details, CV, cover letter, certificates and other documents voluntarily submitted by you. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG (data processing for the purposes of the application process).

If, as part of your application, you provide us with special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. information concerning a severe disability), the processing is additionally necessary for the exercise of rights or fulfilment of legal obligations under employment law pursuant to Art. 9(2)(b) GDPR.

If no employment relationship is established, we will delete your application documents no later than six months after rejection of the application, unless our legitimate interests prevent deletion (e.g. an obligation to provide evidence in proceedings under the German General Equal Treatment Act, AGG). If you would like us to retain your documents beyond this period for future job opportunities (talent pool), we will separately request your explicit consent pursuant to Art. 6(1)(a) GDPR.

 

7. Newsletter

 

8. Online Appointment Booking with BookIvy

For appointment booking on this website, we use “BookIvy”, a product of Re-Thought Consulting. If you use the BookIvy booking service – whether as an embedded widget/iFrame or via the linked booking page – we process the data you provide (including name and, depending on the configuration, email address, telephone number, company as well as information on the desired service, person, date and time) in order to receive, manage and confirm your appointment request.

BookIvy processes this data exclusively as a processor on our behalf and in accordance with our instructions; a Data Processing Agreement (DPA) is in place.

Storage location: Production data is stored exclusively on servers in Germany. Backup copies remain within the European Union. This data is not stored outside the EU.

Storage on your device

The booking page does not use cookies. Your browser only stores two pieces of information locally: the form fields completed by you, so that they are not lost when switching between booking steps, and confirmation of the privacy notice, so that it does not appear again every time the page is accessed. Your browser discards the form information when the tab is closed. This local temporary storage does not in itself transmit anything to us – your information only reaches us when you submit the booking. It is technically necessary in order to carry out the booking requested by you (Section 25(2)(2) TDDDG); consent is not required for this.

No Integration of Third Parties

The booking page does not load content from external servers; fonts are also delivered from our own environment. When the booking page is accessed, your IP address is therefore not transmitted to any third-party provider. No audience measurement or analysis of your user behaviour takes place.

Chat Assistant (Chatbot)

If the BookIvy chat assistant is integrated into this website, your chat inputs are processed in order to support you in finding and booking an appointment. To process your natural-language inputs, content is transmitted to AI service providers (OpenAI and/or Anthropic). In this context, individual data fragments may also be processed outside the EU (e.g. in the USA).

AI Assistants in the Administration Area

In BookIvy’s internal administration area, we use AI assistants (e.g. to support settings and analyses). In this context, individual data fragments from booking data are transmitted to AI service providers (OpenAI and/or Anthropic); processing outside the EU (e.g. in the USA) may be possible. This function relates exclusively to our internal administration and not to the public booking form.

 

9. Disclosure of Data to Third Parties

Your personal data will not be transferred to third parties for purposes other than those listed below. We only disclose your personal data to third parties if:

• you have given your explicit consent pursuant to Art. 6(1)(a) GDPR,

• the disclosure is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed (Art. 6(1)(f) GDPR),

• there is a legal obligation to disclose the data (Art. 6(1)(c) GDPR), or

• this is legally permissible and necessary for the performance of contractual relationships with you (Art. 6(1)(b) GDPR).

In this context, we use in particular the following processors or recipients: Wix.com Ltd. (hosting, website builder, where applicable newsletter distribution) and Re-Thought Consulting (BookIvy, appointment booking). A Data Processing Agreement pursuant to Art. 28 GDPR is in place with Re-Thought Consulting; with Wix, the Data Processing Addendum provided by Wix applies.

 

10. Rights of Data Subjects

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)

• Right to rectification or erasure (Art. 16, 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to object to processing (Art. 21 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, you can contact us at any time using the contact details stated in Section 1.

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority is:

   Bavarian State Office for Data Protection Supervision (BayLDA)

   Promenade 27, 91522 Ansbach

   www.lda.bayern.de

 

11. Data Security

We use the widely established SSL/TLS protocol when you visit our website, in conjunction with the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption. You can tell whether an individual page of our website is transmitted in encrypted form by the closed key or padlock symbol in your browser’s status bar.

We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

 

12. Validity and Amendments to this Privacy Policy

This Privacy Policy is currently valid and was last updated in August 2026. Due to the further development of our website and services or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. The current Privacy Policy can be found at any time at www.reworthblocks.de/datenschutz