Privacy policy

This policy explains what personal data this website processes, why, and what rights you have.

1. Who is responsible

The controller for this website is:

2nd wind GmbH
Ludwigstraße 8
80539 Munich, Germany
Email: hello@2nd-wind.com

Our London office is run by 2nd wind IT Limited, 124 City Road, London EC1V 2NX, United Kingdom. Where it handles your enquiry, in particular enquiries from the United Kingdom, it is the controller in its own right and processes your data under the UK GDPR. Passing your enquiry to it rests on the European Commission’s adequacy decision for the United Kingdom (Art. 45 GDPR). You can reach it at hello@2nd-wind.com as well.

2. Hosting and server logs

This website is delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, acting as our processor. When you open a page, Cloudflare processes the data that is technically necessary to deliver it: your IP address, the date and time of the request, the page requested, the page you came from, and your browser and operating system.

We use this data only to deliver the website and to protect it against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure, working website. Cloudflare keeps this data only as long as these purposes require and then deletes it in line with its retention periods (see Cloudflare’s privacy policy). Cloudflare may process data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework, and its data processing terms include the EU standard contractual clauses. You can check the certification at dataprivacyframework.gov and read the contractual terms at cloudflare.com/cloudflare-customer-dpa. We don’t combine this data with other data.

3. No tracking

We don’t set cookies ourselves and don’t use analytics, advertising or social media tools. To protect the website against automated attacks, Cloudflare may set a strictly necessary security cookie (such as __cf_bm). It expires after 30 minutes and isn’t used to track you. The legal basis is § 25(2) No. 2 TDDDG (in the United Kingdom: regulation 6 PECR) together with Art. 6(1)(f) GDPR.

Country and language. When you open the bare address 2nd-wind.com, our server at Cloudflare uses your browser’s language settings and the country Cloudflare derives from your IP address to send you to the matching language version. The country and language picker at the bottom of each page asks our server for the same country, to suggest it, and so does a short hint that offers you a page in the version for your country or language. Neither is stored. If you choose a country in the picker or answer the hint, your browser keeps that choice in its local storage (not a cookie), so the picker can show it on your next visit and the hint doesn’t come back. It never leaves your device, and you can delete it at any time in your browser settings. The legal basis is § 25(2) No. 2 TDDDG (in the United Kingdom: regulation 6 PECR), as you asked for the choice to be kept, together with Art. 6(1)(f) GDPR; our legitimate interest is showing you the right version of the website.

Fonts are served from our own website, so your browser doesn’t connect to third-party font services.

4. When you contact us

If you contact us through the contact form, the website chat or by email, we process the details you give us, such as your name, contact details and message, to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or steps before one, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. We keep your enquiry for as long as we need it to answer you and to follow it up. If a contract follows, your details become part of our client records; if not, we delete the enquiry once we no longer need it. Business correspondence and accounting records that fall under statutory retention periods (in particular § 257 HGB and § 147 AO: six or eight years) we keep for those periods and delete afterwards.

Contact form. The form sends us what you enter (name, company, email address, phone number if you give one, and your message) and the page and language version you sent it from. It goes through Cloudflare (section 2) and Microsoft Power Automate (Workflows) to Microsoft Teams, both part of Microsoft 365, where our team reads and answers it. The form sets no cookies and loads nothing from third parties. To block spam it checks a hidden field and how long the form took to fill in. Providing your details is voluntary; we need your name, company, email address and message to answer you, and the phone number is optional.

Website chat. If you open the chat on our website, we process what you enter (your name, your company if you give it, your email address and your messages) together with the page and language version you chat from and the time of each message, to answer you. The chat is our own software on this website; no third-party chat service is involved. Your messages reach our team in Microsoft Teams through a bot we run in Microsoft Azure (Azure Bot Service, Microsoft Ireland Operations Ltd., see below), and our replies come back the same way. The chat button loads nothing and stores nothing until you start a chat. Then your browser keeps the chat’s identifier in its local storage (not a cookie) so the conversation can continue on other pages; it is used only to show you your own chat, and you can delete it at any time in your browser settings (§ 25(2) No. 2 TDDDG; in the United Kingdom regulation 6 PECR). The copy of the chat on our website is deleted automatically 30 days after the last message; the copy in Microsoft Teams is kept like any other enquiry (see above). The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or steps before one, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. Providing your details is voluntary; we need your name, email address and a message to start a chat.

For email, the contact form and the website chat we use Microsoft 365 (Exchange Online, Microsoft Teams and Power Automate) and Microsoft Azure (Azure Bot Service), provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, acting as our processor. Data may also be processed in the USA; Microsoft is certified under the EU-US Data Privacy Framework, and the EU standard contractual clauses in Microsoft’s Data Protection Addendum apply in addition.

5. Links to other websites

Some pages link to other websites, for example a map service for directions or a vendor’s documentation. Data is only sent to those sites when you click the link, and their own privacy policies apply.

6. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), and to receive it in a portable format (Art. 20). To exercise these rights, write to hello@2nd-wind.com.

Right to object: where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). We then stop processing it unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

We don’t use automated decision-making or profiling.

Complaints to us. You can raise any data protection complaint with us directly, by email to hello@2nd-wind.com or by post to the address above. We acknowledge receipt within 30 days, look into the complaint without undue delay and tell you the outcome. Your right to contact a supervisory authority is unaffected.

You also have the right to complain to a data protection authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. In the United Kingdom, you can contact the Information Commission (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk.

7. Changes to this policy

We update this policy when the website or the law changes. The date at the top shows the current version.