Legal
Privacy policy
Last updated: September 2026
This privacy policy informs you which personal data we process when you visit this website and use our forms, the purposes for which we process it and the rights you have. Personal data means any information relating to an identified or identifiable person.
1. Controller
The controller responsible for data processing on this website is:
Neue Warnow Design & Technology GmbH
Lübecker Str. 32
18057 Rostock
Telephone: +49 381 2528-0
Email: info@warnowdesign.de
Data protection officer
We have appointed an external data protection officer. Contact details:
Dennis Manz
Datenschutzberater.NRW GmbH
Sülzgürtel 86
50937 Köln (Cologne)
Germany
Telephone: +49 221 29 27 29-0
Email: datenschutz@datenschutzberater.nrw
2. Your rights
Subject to the statutory requirements, you have the following rights against us in relation to personal data concerning you:
- right of access (Article 15 GDPR),
- right to rectification (Article 16 GDPR),
- right to erasure (Article 17 GDPR),
- right to restriction of processing (Article 18 GDPR),
- right, upon request, to be informed of the recipients to whom a rectification, erasure or restriction of processing has been communicated (Article 19 GDPR),
- right to data portability (Article 20 GDPR),
- right to object (Article 21 GDPR; see below).
Right to object
If we process your personal data on the basis of Article 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.
You may withdraw your consent at any time with effect for the future. The relevant method of withdrawal is described in the following sections. Alternatively, you may contact us using the contact details above. The lawfulness of processing carried out before consent was withdrawn remains unaffected.
You also have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular with the supervisory authority for your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania (Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern), Lennéstraße 1, Schloss, 19053 Schwerin, www.datenschutz-mv.de.
3. Hosting and server log data
This website is operated on the HubSpot platform. The provider is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA. The data for this website is stored in data centres within the European Union. We have entered into a data processing agreement with HubSpot pursuant to Article 28 GDPR. Where personal data is transferred to HubSpot, Inc. in the USA in individual cases, the transfer is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework; HubSpot, Inc. is certified under this framework. The European Commission’s standard contractual clauses also apply. HubSpot provides a copy of the standard contractual clauses and further information about the safeguards in its data processing agreement at legal.hubspot.com/dpa; you may also obtain them on request using our contact details above.
Each time you access this website, the server automatically processes data transmitted by your browser: IP address, date and time of the request, page accessed, amount of data transferred, browser type and operating system, as well as the previously visited page (referrer), if your browser transmits this information. This data is required to deliver the website and ensure its security. The legal basis is Article 6 (1) (f) GDPR, our legitimate interest in the secure and stable operation of the website. The log data is stored only for as long as required to operate the website and defend it against attacks and is then deleted. It is not analysed for any other purposes.
Services provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, are also used to deliver and secure the website. In particular, your IP address and technical connection data may be processed. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest is in providing the website securely and reliably and protecting it against misuse. Where Cloudflare sets the technically necessary cookies referred to in Section 4 for this purpose, Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. Where Cloudflare processes personal data in the USA, the transfer is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework; Cloudflare is certified under this framework.
4. Cookies and audience measurement
This website uses cookies. Technically necessary cookies are required to operate the website and are set without consent. The legal basis is Section 25 (2) TDDDG in conjunction with Article 6 (1) (f) GDPR.
HubSpot uses cookies for audience measurement. These cookies recognise returning visitors and enable the statistical analysis of page views. They are set only after you have given your consent via the cookie banner. The legal basis is Section 25 (1) TDDDG in conjunction with Article 6 (1) (a) GDPR. You may withdraw your consent at any time via the cookie settings.
| Cookie | Purpose | Category | Duration |
|---|---|---|---|
| __cf_bm | Bot protection when delivering the website | Necessary | 30 minutes after the last activity |
| __cfruid | Limits unusually high numbers of requests (rate limiting) | Necessary | Session |
| __hs_cookie_cat_pref | Stores the categories selected in the cookie banner | Necessary | 6 months |
| hubspotutk | Recognises a visitor; is passed to HubSpot when a form is submitted and is used to deduplicate contacts | Statistics | 6 months |
| __hstc | Stores the first, previous and current visit and the session number | Statistics | 6 months |
| __hssc | Records sessions and page views within a session | Statistics | 30 minutes |
| __hssrc | Identifies a new session based on a browser restart | Statistics | Session |
5. Contact form and other contact
If you write to us using the contact form, we process the information you enter there: company name, first name, surname, email address, telephone number, the category of your enquiry and your message. The mandatory fields are your email address, the category and your message; all other information is voluntary. The form cannot be submitted without the mandatory information. The data is transmitted to us via HubSpot and stored in our customer relationship management system (HubSpot CRM) so that we can process and respond to your enquiry.
The legal basis is Article 6 (1) (b) GDPR where your enquiry relates to a contract or steps taken prior to entering into a contract, and otherwise Article 6 (1) (f) GDPR, our legitimate interest in responding to enquiries. We delete the data once your enquiry has been fully dealt with, unless statutory retention obligations or requirements for the establishment, exercise or defence of legal claims prevent its deletion.
If you contact us by email, telephone or fax, we process the contact details and content you provide in order to deal with your enquiry. The same legal bases and deletion criteria apply.
6. Job applications
If you apply to us via our application form or by email, we process your details and documents to decide whether to enter into an employment relationship with you. Providing the data required to assess your application is necessary for the recruitment process; without this data, we cannot assess your application. Any further information is voluntary. The legal basis is Section 26 (1) sentence 1 of the German Federal Data Protection Act (BDSG); where your documents contain special categories of personal data and their processing is necessary for the procedure, additionally Section 26 (3) BDSG.
We use HubSpot forms for the application form. We store your data in our HubSpot CRM system and uploaded files in HubSpot’s file manager (see Sections 3 and 5). Within the company, only the people responsible for the recruitment process and authorised accordingly have access. To run the recruitment process, we use processors, in particular HubSpot for applicant management and our email service provider. We conduct online interviews via Microsoft Teams provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, on the basis of a data processing agreement. A transfer to the USA cannot be ruled out; it is safeguarded by the EU standard contractual clauses and Microsoft’s certification under the EU-US Data Privacy Framework. Interviews are not recorded.
For unsuccessful applications, the procedure is deemed to have ended when we send our rejection. We then retain your data for up to six months in order to defend against possible claims under the German General Equal Treatment Act (AGG). The legal basis for this is our legitimate interest under Article 6 (1) (f) GDPR; where the data required for this contains special categories of personal data, the additional legal basis is Article 9 (2) (f) GDPR. We delete special-category information that is not required earlier. After that, we delete your data unless legal reasons require longer storage. If legal proceedings are pending, we store the data required for them until the proceedings have ended. Statutory retention obligations remain unaffected.
If we would like to consider your application for future positions and contact you when a suitable position becomes available, we will ask for your consent after the procedure has ended (Article 6 (1) (a) GDPR in conjunction with Section 26 (2) BDSG). In the talent pool we then store only your contact details and application documents, limited to twelve months from your consent; an extension requires that you consent again. We do not transfer any special categories of personal data within the meaning of Article 9 GDPR to the talent pool; if your documents contain such information, we remove it before transfer or do not transfer the affected documents to the talent pool. Outside the talent pool, we keep a record of your consent with its date, scope and the text version used until the end of the talent pool period, including after a withdrawal; the legal basis for this is Article 6 (1) (c) GDPR in conjunction with Article 7 (1) and Article 5 (2) GDPR.
You can withdraw your consent at any time with effect for the future, for example by emailing career@warnowdesign.de. Withdrawing your consent does not affect the lawfulness of processing based on your consent before its withdrawal. After you withdraw your consent, we no longer use your data for the talent pool. Unless there is another legal basis for further storage, we delete the contact details and application documents stored for this purpose; if the six-month retention period mentioned above is still running, we keep the data required for it at most until that period ends. Once the talent pool period has expired, we delete your contact details, application documents and the record of your consent.
7. Interactive project map
On some pages, we display a map showing the locations of our projects. The map is loaded only when you click “Load map”. No connection to map providers is established before then. When you click the button, the map tiles are loaded from the OpenFreeMap service (openfreemap.org), provided by Hyperknot Software Kft., based in Hungary, and the MapLibre GL JS map library is loaded via the UNPKG content delivery network. UNPKG is delivered through the global network and Workers infrastructure of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your IP address and technical information about your browser are transmitted to these providers. According to its own information, OpenFreeMap does not log IP addresses by default; in the event of a security incident, logging may be enabled temporarily for no longer than 30 days. Cloudflare is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent under Article 6 (1) (a) GDPR and Section 25 (1) TDDDG. Your decision is stored locally in your browser so that you do not have to make it again on every page. You may withdraw your consent at any time with effect for the future: below each loaded map, you will find the “Withdraw map consent and hide the map” button. This also deletes the selection stored locally. The selection remains stored until you withdraw your consent or delete the website data stored locally in your browser.
8. Fonts and files
The fonts used on this website are delivered from the servers of our hosting platform. No connection to Google or other font providers is established when the fonts are loaded. Documents available for download, such as our policy statement under the German Supply Chain Due Diligence Act, are also stored on the hosting platform.
9. Links to social networks
Our website contains a link to our company profile on LinkedIn. This is a simple link; no LinkedIn content is embedded. You leave our website only when you click the link. Data processing by LinkedIn is governed by the privacy policy of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
10. Data security
Data transmitted between your browser and this website is encrypted using TLS. We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access.
11. Updates to this privacy policy
This privacy policy was last updated in September 2026. We will update it if we develop the website further or if legal requirements change. The current version is available on this page.