Privacy Policy

1. The Purpose of this Privacy Notice

This privacy notice explains how we process personal data when you use our WM Datenservice online service. Information on the data processing of other services of the WM Group will be provided to you in the context of the respective service. For websites of other providers, which are referred to e.g. via links, the data protection information and declarations of those providers apply.

2. Contact details of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States as well as other data protection provisions is:
Keppler, Lehmann GmbH & Co. KG (in short: „WM Group“)
Düsseldorfer Strasse 16
60329 Frankfurt a. M.
Phone +49 (0)69 2732-0
WM Group has appointed a Data Protection Officer (DPO) who can be contacted at the above address. If you wish to contact the DPO on a confidential basis, please add a corresponding note („Data Protection Officer – personal / confidential“) to the address. You can reach the DPO by e-mail at the address

3. Rights of the data subject

Every data subject has the right of access according to Art. 15 DSGVO, the right to rectification according to Art. 16 DSGVO, the right to erasure („right to be forgotten“) according to Art. 17 DSGVO, the right to restriction of processing („blocking“) according to Art. 18 DSGVO, the right to object according to Art. 21 DSGVO as well as the right to data portability from Art. 20 DSGVO, provided you have consented to the data processing or have concluded a contract with us. With regard to the right to information and the right to deletion, the restrictions according to §§ 34 and 35 BDSG apply.

consent to a specific processing of your personal data, you can revoke this consent at any time. Whenever we process your data on the basis of a legitimate interest or a balancing of interests, you can object to such processing at any time.

If we contact you for sales reasons and you do not wish this, a simple and clear notice is sufficient for a stop; no justification is required.

Finally, you still have a right of appeal to the supervisory authority in accordance with Art. 77 DSGVO in conjunction with § 19 BDSG.

For us, the supervisory authority is:

    Der Hessische Beauftragte für Datenschutz und Informationssicherheit (HBDI)
    P.O. Box 31 63
    65021 Wiesbaden
    Telefon: +49 611 1408-0

4. General information on data processing


4.1. Scope of the processing of personal data

As a matter of principle, we process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. The processing of personal data of our users is based on our legitimate interest.

4.2. Legal basis for the processing of personal data

The processing of personal data is only permitted if one of the legal bases listed in Art. 6 (1) DSGVO is applied. In the following, we do not want to repeatedly refer to paragraphs or articles of the DSGVO, but rather explain in general terms, if possible, why and how data is processed at the online presence of the WM Group. We will then refer to the respective legal bases by their colloquial name (in italics in each case).
Of the total of six possible legal bases, four are relevant for the online presence of the WM Group:

  • Consent (Art. 6 para. 1 lit. a DSGVO): You voluntarily consent to a precisely described additional processing. The use of WM Gruppe’s online offer is also possible without consent. Consent given once can be revoked at any time for the future. Example: permission to set an advertising cookie.
  • Contract (Art. 6 para. 1 1 lit. b DSGVO): When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) 1 lit. b DSGVO serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
  • Legal obligation (Art. 6 para. 1 1 lit. c DSGVO): Some data must be processed because it is so required. Example: retention periods for tax-relevant data.
  • Balancing of interests or legitimate interest (Art. 6 (1) (f) DSGVO): Can be applied if legitimate interests are pursued and processing is necessary for this purpose. Mandatorily requires that we have carefully weighed up in advance whether your interests as a data subject are not unreasonably affected. You can object to processing at any time. An effective objection shall terminate the data processing. Example: advertising e-mail addressed to you as a customer (direct advertising).
4.3. Data deletion and duration of storage

The legislator has enacted a variety of retention periods and obligations. After these periods have expired, the corresponding data is routinely deleted. If data is not affected by this, it will be deleted or made anonymous if the purposes stated in this data protection declaration cease to apply. Unless this Privacy Policy contains other, deviating provisions regarding the storage of data, the data collected by us will be stored by us for as long as it is required for the aforementioned purposes for which it was collected.
Further processing or use of your personal data will generally only take place if permitted by a legal requirement or if you have consented to the data processing or use. In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes prior to further processing and provide you with the further relevant information.

5. What data do we process and why?


5.1. Visiting our website

When you visit our website, our system collects data and information that your Internet browser transmits to us. This processing takes place in the same or similar way on all websites on the Internet. The following data is collected:

  • the current IP address of the Internet connection you are using;
  • if you visit our website via a link, the page from which you visit us;
  • the web pages that you visit within our Internet offering;
  • the date and time of your visit;
  • the operating system you use, the browser name (e.g. Internet Explorer, Firefox, etc.) and the browser version;

We process this data for the purpose of maintaining the functionality and also security of our website. In aggregated form, i.e. no longer with a direct reference to your personal data, we also use the data to optimize the usability of the content. Hereby we pursue our legitimate interests. The data is processed for a maximum of 7 days and then deleted.
Abuse detection and tracking
We generally retain information for abuse detection and tracking, in particular your IP address, for at least four months. We base the maximum storage period on the specifications prescribed by the BDSG for operators of state web servers in Germany (neither the BDSG nor the DSGVO provide specific specifications for private web servers. All of the aforementioned processing activities are carried out on the basis of our legitimate interest in operating a secure website and in the legal prosecution of persons who wish to harm our customers or us.

5.2. Google Tag Manager

We use Google Tag Manager, a tag management system provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“ for short). Google Tag Manager allows us to embed and manage tracking or statistical tools and other third-party technologies on our website – i.e. for technical purposes. The Google Tag Manager itself does not create user profiles, does not store cookies and does not perform any independent analyses. It only serves to manage and play out the tools integrated via it. The Google Tag Manager does, however, record your IP address, which may also be transferred to Google’s parent company in the United States. You can find more information about Google Tag Manager here: and in Google’s privacy policy:

5.3. Cookies

5.3.1. Use of Cookies
In order to make our website user-friendly for you and to adapt it ideally to your needs, we use cookies in some areas. A cookie is a small file that is stored locally on your computer when you visit a website. If you visit the website again with the same device, the cookie indicates, for example, that it is a repeat visit. Cookies also enable us to analyze the use of our website. The cookie does not contain any personal information, it is not capable of identifying you on third party websites, including the websites of analytics providers.
We use the following types of cookies:

  • • Basic/essential cookies
    These cookies are fundamental to the functioning of our website. This is, for example, the allocation of anonymous session IDs to bundle multiple queries to a web server or the error-free functioning of logins and orders.
  • Functionality Cookies
    These cookies help us to save settings you have chosen or support other functions when you navigate our website. For example, we may remember your preferred settings for your next visit or store your login information for certain areas of our website. These cookies are set after you have given your consent.
  • Performance/Statistics Cookies
    These cookies collect information about how you use our website (e.g. internet browser used, number of visits, pages viewed or time spent on the website). These cookies are set after your consent.

These cookies do not store information that allows personal identification of the visitor. The information collected with the help of these cookies is aggregated and therefore anonymous.

5.3.2. Use of Cookiebot
In order to obtain consent for the use of cookies in accordance with data protection laws, we use the cookie banner from Cookiebot (Cookiebot – Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark). The cookie banner collects and stores consent to cookie use. We do not reload cookies that are not necessary until you have consented to their use.
When you visit our websites, a Cookiebot cookie is stored in your browser. This is where your consent or revocation is stored. This data is not passed on to the provider of Cookiebot.
The collected data will be stored until you request us to delete it or until you delete the Cookiebot cookie yourself or until the purpose for storing the data no longer applies. Mandatory legal retention periods remain unaffected. Details on the data processing of Cookiebot can be found at

5.4. Registration for whitepapers, mailings and/or the download of certain documents and content

On our website, we provide an offer of mailings, downloads and whitepapers on the basis of the user’s consent pursuant to Art. 6 (1a) GDPR, where applicable in conjunction with Section 7 (2) No. 3 UWG. We may also send users certain information by e-mail on the basis of legal permission pursuant to Section 7 (3) UWG, if applicable.
In order to register for topic-related whitepapers, mailings and/or the download of certain documents and content provided by us, the user’s name and e-mail address must be provided. Other information, such as company and position, is always voluntary and does not have to be provided. By registering or downloading, the user also gives us permission to record future visits to our website on a personal basis in order to be able to send the user targeted and personally tailored topic-related information and information about our offers. In doing so, we use a cookie from our service provider WordPress to record our website and individual topics that a registered user views when visiting our website.
The user also consents to us contacting the user personally by email and, if voluntarily provided, by telephone, in accordance with the information provided to us, in order to communicate topic-related offers or developments of offers of our company.
After registering for whitepapers, mailings and/or downloads on our website, the respective user receives a confirmation e-mail to the e-mail address provided (so-called double opt-in procedure). Only after clicking on the link contained in this e-mail is the registration completed.
Once given consent to receive whitepapers, mailings, downloads or personal contact by phone can be revoked at any time via a link at the end of each e-mail or by sending an e-mail to for the future.
Registrations for whitepapers, mailings and/or downloads are logged on the basis of our legitimate interest in being able to prove the registration and consent of a user at any time (Art. 6 para. 1 lit. f GDPR).
If a user has not used our offers in any form for one year after the last visit to our website, we assume there is no further interest in using our offers and the user is automatically deleted from WordPress.

5.4.1. Use of Rapidmail

We use rapidmail to send mailings, white papers, etc. The provider is rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany. Among other things, rapidmail is used to organize and analyse the sending of mailings. The data you enter for the purpose of receiving newsletters/mailings is stored on rapidmail’s servers in Germany. The data is not transferred to third countries. If you do not wish to be analyzed by rapidmail, you must unsubscribe from the mailings. We provide a link for this purpose in every mailing. The data stored by us as part of your consent for the purpose of the mailing will be stored by us until you unsubscribe from the mailing and deleted from both our servers and rapidmail’s servers after you unsubscribe from the mailing. Data stored by us for other purposes (e.g. e-mail addresses for the member area) remain unaffected by this.
For the purpose of analysis, the emails sent with rapidmail contain a so-called tracking pixel, which connects to the rapidmail servers when the email is opened. This makes it possible to determine whether a mailing has been opened. We can also use rapidmail to determine whether and which links in the mailing have been clicked on. Optionally, links in the email can be set as tracking links with which your clicks can be counted.
You have the option of withdrawing your consent to data processing at any time with effect for the future. The legality of the data processing operations that have already taken place remains unaffected by the revocation.
Further data protection information: For more information, please refer to rapidmail’s data security information at: For more information on the analysis functions of rapidmail, please refer to the following link:

5.5. Contact form

If you would like to contact us or if you have more detailed questions for us or about our products, you can send us a message using the contact form on our website. The required data are marked as mandatory fields.
When you contact us, the data you provide (in particular your first and last name, your e-mail address and the text of your inquiry, as well as any other information) will be stored by us. In the case of further information, this information is provided voluntarily. The processing of the transmitted personal data takes place for the treatment of the establishment of contact and/or for the initiation of a contractual relationship.
The data collected in the course of contacting you will be deleted as soon as they are no longer required for processing your request.

5.6. Applications

In the course of your online application, we will collect and process the following personal application data from you:

  • Name, first name
  • Address
  • Telephone number
  • Email
  • • Application documents (cover letter, resume, references, certificates, etc.)

On our career site you have the option of applying online for advertised positions or submitting a speculative application. If you make use of this offer, a new window will open with an application form. This form is provided by Sage GmbH, Franklinstraße 61-63, 60486 Frankfurt am Main, Germany, a subsidiary of Sage Group plc, Newcastle Upon Tyne, United Kingdom. An order processing agreement has been concluded with Sage. After completion of the online application process, Sage transfers the data to us (WM Group), where it is stored for further use.
Your personal application data is collected and processed exclusively for the purpose of filling vacancies within our company on the basis of a contract initiation and § 26 BDSG. As a matter of principle, your data will only be forwarded to the internal departments and specialist departments of our company responsible for the specific application procedure. Your application data will not be used for any other purpose or passed on to third parties. In certain cases, we process your data to protect a legitimate interest of ours or of third parties, if it is necessary to defend legal claims in proceedings under the General Equal Treatment Act (AGG).
We store your applicant data for the duration of the review of your application. If your application is unsuccessful or if you withdraw your application, your application data will be deleted after a maximum of 6 months, unless you have expressly agreed to longer storage. (Legitimate interest). In the event of a successful application, the data you have provided to us via the application system will be further processed in relation to your future employment at our company with the aim of concluding an employment contract.

5.7. Social media presence

We maintain a publicly accessible profile on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). As the servers for this are located in the USA, your personal data may be processed outside the EU. To ensure appropriate guarantees for the protection of the transfer and processing of personal data outside the EU, the transfer of data to as well as the processing of data by the social media operators outside the EU takes place on the basis of appropriate guarantees pursuant to Art. 46 et seq. DSGVO, in particular by concluding so-called standard data protection clauses according to Art. 46 para. 2 lit. c DSGVO.
These pages serve as a communication and information channel for us to provide information about our offers. In doing so, we collect and process your personal data in accordance with our legitimate interest (Art. 6 para. 1 lit. f DSGVO). However, since we generally or to a large extent have no influence on the processing of your personal data by the LinkedIn companies jointly responsible for the corporate presence, we cannot provide any binding information on the purpose and scope of the processing of your data.
We would like to point out that you use these pages and their functions on your own responsibility, especially for the use of the interactive functions (for example, commenting, rating or sharing).
Further information on the processing of your personal data by LinkedIn and the corresponding objection options can be found here:

5.8. Embedded videos

We may have embedded videos from the provider Vimeo LLC, headquartered at 555 West 18th Street, New York, New York 10011.
Some of our webpages contain videos from Vimeo. When you call up such a page on our website, a connection is established to the Vimeo servers. This transmits to the Vimeo server which of our Internet pages you have visited. If you are logged in as a member of Vimeo, Vimeo assigns this information to your personal user account. When you click on the start button of a video, this information can also be assigned to an existing user account. You can prevent this assignment by logging out of your Vimeo user account before using our website and deleting the corresponding cookies from Vimeo. We use this service within our online offer on the basis of a legitimate interest – the analysis, optimization and economic operation of our online offer.
You can find out more information about data protection at Vimeo and the use of cookies here:

5.9. Tracking

To analyze the use of our website, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: „Google“). The data is used to evaluate your use of our website as well as to optimize our website. Google Analytics is only used if you have given us your consent via our cookie banner.
Google Analytics examines, among other things, the origin of visitors, their length of stay on individual pages and the use of search engines and thus allows a better control of the success of advertising campaigns. Google sets a so-called „cookie“, a text data stored in the browser, on your computer. This allows personal data to be stored and evaluated, including:

  • The user’s activity (in particular, which pages have been visited and which elements have been clicked on),
  • device and browser information (in particular the IP address and the operating system),
  • data about the advertisements displayed (in particular, which advertisements were displayed and whether the user clicked on them), and
  • data from advertising partners (in particular pseudonymized user IDs).

The information generated by the cookie about the use of this website is usually transmitted to a Google server in the USA and stored there. In the event that IP anonymization is activated on this website, however, Google will truncate the user’s IP address beforehand within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.
The IP address transmitted by the browser used as part of Google Analytics will not be merged with other data from Google.
We further point out that on this website Google Analytics has been extended by the code „anonymizeIp“ to ensure anonymized collection of IP addresses (so-called IP masking).
More information on the terms of use and data protection at Google can be found at bzw. unter

5.10. Google Maps

This website uses the Google Maps API, a map service provided by Google Inc („Google“), to display an interactive map. By using Google Maps, information about your use of this website (including your IP address) may be transmitted to and stored by Google on servers in the United States.
Google may transfer the information obtained through Maps to third parties if required to do so by law, or if such third parties process the information on Google’s behalf.
Google will not associate your IP address with any other data held by Google. Nevertheless, it would be technically possible for Google to identify at least individual users on the basis of the data received. It would be possible that personal data and personality profiles of users of the website could be processed by Google for other purposes over which we have and can have no influence. This and the fact that data is transferred to the USA is problematic for data protection reasons.
If you do not agree with the future transmission of your data to Google in the context of the use of Google Maps, you also have the option of completely deactivating the Google Maps web service by turning off the JavaScript application in your browser. Google Maps and thus also the map display on this website can then not be used.
By using this website and not deactivating the JavaScript function, you expressly declare, in awareness of the data protection issues, that you agree to the processing of the data collected about you by Google in the manner and for the purpose described above.

5.11 SalesViewer

Use of SalesViewer® technology:
This website uses SalesViewer® technology from SalesViewer® GmbH on the basis of the website operator’s legitimate interests (Section 6 paragraph 1 lit.f GDPR) in order to collect and save data on marketing, market research and optimisation purposes.
In order to do this, a javascript based code, which serves to capture company-related data and according website usage. The data captured using this technology are encrypted in a non-retrievable one-way function (so-called hashing). The data is immediately pseudonymised and is not used to identify website visitors personally
The data stored by Salesviewer will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them.
The data recording and storage can be repealed at any time with immediate effect for the future, by clicking on in order to prevent SalesViewer® from recording your data. In this case, an opt-out cookie for this website is saved on your device. If you delete the cookies in the browser, you will need to click on this link again.

6. Automated decision-making

As a responsible company, we do not use automated decision-making or profiling.

Updates of our privacy policy

We reserve the right to update this privacy policy so that it always complies with the current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.