Privacy policy

Last updated: 6 October 2026

1. Controller and data protection officer

Webmetic GmbH
Grünwalder Weg 32
82041 Oberhaching, Germany
Phone: +49 89 3183 5253
Email: mail@webmetic.de

You can reach our data protection officer at datenschutz@webmetic.de.

2. Hosting and server logs

We host our website, application, databases and files with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in the EU. Hetzner processes the data on our behalf (Art. 28 GDPR).

When you open our pages, the server automatically logs your browser type and version, operating system, referrer URL, host name, the time of the request and your IP address. We need this data to run the website securely and without errors, and we don't combine it with other data. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

3. Cookies

Our website and application use cookies and similar technologies. We set technically necessary cookies, for example to keep you signed in to your account, based on our legitimate interest (Art. 6(1)(f) GDPR). Sections 4 to 7 list the services that set further cookies.

You can set your browser to allow cookies only case by case, block them entirely or delete them when you close it. Some features of the website may then not work.

4. Contact and customer account

Contacting us

When you contact us through the contact form, by email or by phone, we store your details to handle your request and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise our legitimate interest in handling it (Art. 6(1)(f) GDPR). We delete the data once your request is resolved and no retention obligations apply.

Booking a meeting

You book meetings with us through meetergo (meetergo GmbH, Monheim am Rhein, Germany). meetergo processes your details (such as name, email address and preferred time) on our behalf on servers in Germany. The legal basis is Art. 6(1)(b) GDPR.

Customer account and trial

For your customer account and the 14-day trial, we process your registration details (such as name, business email address, company and domain) and usage data from your account. The legal basis is Art. 6(1)(b) GDPR. We keep the data for as long as your account exists.

Payments

Payments are processed by Stripe (Stripe Payments Europe, Limited, Dublin). Stripe processes your payment details and, as a controller in its own right for fraud prevention, device and connection data; Stripe may set cookies for this. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for fraud prevention.

Traffic estimate

When you request a traffic estimate for a domain on our website, we store the domain, the time, the page you started from, your IP address, your browser and, if known, your email address. We use this to prevent misuse and to see which companies are interested in Webmetic (Art. 6(1)(f) GDPR).

5. Newsletter

To send you our newsletter, we need your email address and your confirmation that you want to receive it. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time using the unsubscribe link in every newsletter. If you are a customer, we may also send you information about similar services of our own without a separate sign-up (Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition, UWG); you can object to this at any time.

We send the newsletter and emails about your account through Customer.io (Peaberry Software, Inc., USA, data stored in Belgium) and track whether emails are opened and links clicked. When you unsubscribe, we remove your address from the mailing list and keep it on a suppression list so you don't receive further newsletters.

6. Analytics, advertising and error tracking

We load the following services through Google Tag Manager or directly in our website and application. We use them based on our legitimate interest (Art. 6(1)(f) GDPR) to understand how the website and application are used, fix errors and measure how well our advertising works. These services may set cookies and receive your IP address along with information about your browser, device and the pages you view. You can object at any time (section 10).

* With session recording: the course of a visit (page layout, mouse movements, clicks) is recorded, for Sentry only when an error occurs. Webmetic masks anything typed into form fields.

Opt-out options from the providers:

• Google Analytics: tools.google.com/dlpage/gaoptout
• Google ads: myadcenter.google.com
• Microsoft ads: account.microsoft.com/privacy/ad-settings
• LinkedIn ads: linkedin.com/psettings/guest-controls/retargeting-opt-out
• Webmetic: webmetic.de/sv/opt-out

7. YouTube and LinkedIn

YouTube

On some pages we embed YouTube videos (Google Ireland Limited). When you open such a page, your browser connects to YouTube; YouTube may set cookies and link the visit to your YouTube account if you are signed in. The legal basis is our legitimate interest in presenting our content in an appealing way (Art. 6(1)(f) GDPR).

Our LinkedIn page

For our LinkedIn company page, LinkedIn provides us with aggregated visitor statistics. We and LinkedIn Ireland Unlimited Company are joint controllers for these statistics (Art. 26 GDPR, see the agreement). You can exercise your rights with LinkedIn or with us.

8. The Webmetic platform

Our roles

We process the data our tracking script collects on our customers' websites as a processor (Art. 28 GDPR). The controller is the customer using Webmetic; it's best to direct requests about your rights to them, and we support them in handling these.

We are the controller for our own website, customer accounts and our company identification database.

Tracking on customer websites

Our tracking script collects the IP address, browser and device information such as screen size, language and time zone, the pages viewed with referrer and time on page, and interactions such as clicks on contact links and form use. From form entries we only take the domain of an email address (the part after the @), never the full address. The script sets no cookies of its own but reads the ID from a Google Analytics cookie if one exists. If the customer enables it, we record the course of a visit; anything typed into form fields is masked.

This shows our customers which companies visit their website, not which people. We store the data for the duration of the customer contract.

Company identification

To match IP addresses to companies, we run our own database, for which we are the controller. It draws on public registration data for IP networks, public company information and pseudonymous observations from tracking on all customer websites, such as the domain of a business email address entered in a form. Matches expire after five years at most. The legal basis is our legitimate interest and that of our customers (Art. 6(1)(f) GDPR).

Smart Pages and lead score

With Smart Pages, customers tailor content on their website to the identified company. The text is generated by Gemini on Google Cloud from page content and public company profiles, without any personal data about visitors. Processing usually takes place in the EU, and outside it when the EU region is overloaded.

For identified companies we calculate a lead score from 0 to 10 based on their visits. It refers to the company, not to an individual, and no automated decision within the meaning of Art. 22 GDPR is made.

9. Transfers to the USA

Google, Microsoft, LinkedIn, Stripe, PostHog, Amplitude, Customer.io and Sentry are based in the USA or may transfer data there; PostHog, Amplitude, Customer.io and Sentry store your data in the EU for us. Transfers to the USA are covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework (DPF). All of these providers are certified under it (list).

10. Retention and your rights

Unless stated otherwise above, we keep your data until the purpose no longer applies or you ask us to delete it, and beyond that only as long as statutory retention periods require.

You have the right to:

• access your data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)
• lodge a complaint with a supervisory authority (Art. 77 GDPR); the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA)

To exercise these rights, email mail@webmetic.de.

Right to object (Art. 21 GDPR)

Where we process your data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation; this also applies to profiling. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims. You can object to processing for direct marketing at any time without giving reasons.

To object to collection by Webmetic on all websites that use Webmetic, go to webmetic.de/sv/opt-out. To honor your objection, we store your IP address together with features of your device (screen resolution, color depth, platform, language); the objection applies to this device and this internet connection.