1. Overview
Protecting your personal data matters to us. This privacy policy explains which data is processed when you visit our websites www.onewave.de and katalog.onewave.de, for what purpose, and which rights you have under the General Data Protection Regulation (GDPR).
In short: our websites use no cookies, no analytics or tracking services and embed no third-party content. We process personal data only when you contact us, register for a notification or apply for a job, and in the form of technically necessary server log files.
2. Controller
The controller within the meaning of the GDPR is:
- Company
- OneWave GmbH
- Address
- Otto-Volger-Str. 3B, 65843 Sulzbach (Taunus), Germany
- Represented by
- Won Chung, Managing Director
- Phone
- +49 69 8700686-0
- info@onewave.de
Please direct questions about data protection and requests concerning your rights to info@onewave.de or by post to the address above.
3. Hosting and server log files
Both websites run on a server (virtual private server) managed by us and provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data centre in Germany. IONOS provides the server infrastructure as a processor under Art. 28 GDPR; the server log files are processed exclusively by us on this server (web server Caddy). When you open a page, your browser automatically transmits data that is stored in the server log files:
- IP address of the requesting device
- date and time of the request
- page or file requested and the amount of data transferred
- HTTP status code
- website from which the request originates (referrer URL)
- browser and operating system used (user agent)
This processing serves the technical operation, stability and security of the websites, in particular the defence against attacks and error analysis. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the websites. This data is not combined with other data sources.
The log files, including the IP address, are deleted no later than seven days after collection. They are kept longer only if a specific security incident has to be investigated; in that case the data is deleted once the investigation is complete.
4. No cookies, no tracking
Our websites set no cookies – neither technically necessary ones nor cookies for analytics or marketing. Other browser storage techniques (e.g. local storage) are not used either. There are no web analytics services, no tracking, no social media plug-ins and no embedded third-party content (e.g. maps or videos).
For this reason no cookie banner is required. Should we use services that require consent in future, we will update this privacy policy and obtain your consent beforehand.
5. Fonts
For a consistent appearance our websites use the typefaces Plus Jakarta Sans and Instrument Serif. Both are stored on our own server and loaded exclusively from there. Opening our websites establishes no connection to servers of Google or other font providers; no data is transmitted to third parties.
6. Contact form and getting in touch
When you send us an enquiry via the contact form, we process the details you enter:
- type of enquiry (brand, retailer or other)
- name
- company
- e-mail address
- your message
- optional: country, phone number and website
The purpose of this processing is to handle and answer your enquiry and to initiate a business relationship. The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries properly. Before sending, you confirm that you have read this privacy policy; consent to the processing is not required for this and is not requested.
The "Send by e-mail" button opens your e-mail program with a prepared message; the message is sent as a normal e-mail to info@onewave.de via your e-mail provider. No form service is used, and your entries are not stored on our server.
On katalog.onewave.de you can ask to be notified as soon as our product catalogue is published. For this we process your e-mail address and – if you provide them – your name and company, solely to inform you once about the publication of the catalogue. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, for example by e-mail to info@onewave.de. The data is transmitted in the same way as the contact form. We delete the data as soon as the notification has been sent or you withdraw your consent.
You can also reach us by e-mail or phone. In that case, too, we process the data you provide solely to handle your request on the legal bases stated above.
Within OneWave GmbH only the staff responsible for handling your enquiry have access to it. We store your enquiry for as long as necessary to handle it. If a business relationship results, we keep the correspondence within the retention periods under commercial and tax law. Otherwise we delete the data once your request has been dealt with and no statutory retention obligations apply.
7. Job applications
Applications reach us via the Indeed platform or by e-mail. We process your application documents solely to carry out the application procedure (Art. 6(1)(b) GDPR, § 26 BDSG). Only the people involved in the procedure have access to them.
After the procedure has ended we delete the documents no later than six months afterwards, unless you have consented to longer storage for future vacancies. If you are hired, the necessary documents are transferred to your personnel file.
For the processing of your data on the Indeed platform – for instance when you create a profile or submit an application through Indeed – Indeed Ireland Operations Ltd., 124 St. Stephen’s Green, Dublin 2, Ireland, is the separate controller; its privacy notice applies.
8. External links
Our websites contain links to external websites. These are plain references; merely opening our pages transmits no data to those providers. Only when you click a link do you leave our website, and the privacy policy of the respective provider applies, over which we have no influence. This concerns in particular:
- LinkedIn and Instagram (Meta) – our company profiles on social networks
- Indeed – our job advertisements (see the section "Job applications")
- Google Maps – directions to our location via the map link on the contact page
- Our B2B shop at b2b-onewave.com – which has its own privacy notice
9. Disclosure of data
We disclose your personal data only as described in this policy, with your consent, or where we are legally obliged to do so. We do not sell your data.
10. Data security
The connection to our websites is TLS-encrypted (recognisable by the "https://" prefix and the padlock symbol in your browser’s address bar). E-mails you send us from your e-mail program are transmitted via your e-mail provider; transport encryption depends on the mail servers involved. For confidential documents, please contact us beforehand.
In addition, we use technical and organisational measures to protect your data against loss, manipulation and unauthorised access. We review these measures continuously in line with technical developments.
11. Your rights
With regard to your personal data you have the following rights:
- access to the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure of your data where no retention obligations apply (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Right to object: where we process your data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms.
To exercise your rights, an informal message by e-mail to info@onewave.de or by post to the address above is sufficient.
12. Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The authority responsible for OneWave GmbH is:
- Supervisory authority
- Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI) – the Hessian Commissioner for Data Protection and Freedom of Information
- Address
- Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
You may also contact the supervisory authority of your habitual residence or place of work.
13. Changes to this privacy policy
We update this privacy policy when the legal situation, our websites or the services we use change. The version published on this page applies.
Last updated: September 2026