Privacy policy

This privacy policy explains which personal data is processed when you visit jw-sustainability.com, for what purpose, and which rights you have.

1. Controller

2. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Whenever a page is requested, Vercel automatically processes the data your browser transmits for technical reasons: IP address, date and time of access, the page requested, the amount of data transferred, browser type and version, operating system and the previously visited page (referrer). This data is needed to deliver the page, for security and for troubleshooting, and is not combined with other data sources. The legal basis is my legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). A data processing agreement is in place with Vercel; where data is transferred to the USA, this is based on appropriate safeguards under Art. 44 et seq. GDPR (EU-US Data Privacy Framework or EU standard contractual clauses).

For the technical maintenance of the website, a script is additionally loaded from app.fento.ai (Fento AI). Your IP address is transmitted to that server for technical reasons. The script only activates for logged-in reviewers and does not collect any further data from visitors. The legal basis is my legitimate interest in maintaining and developing the website (Art. 6(1)(f) GDPR).

3. Contacting me and contact form

If you contact me by e-mail or via the contact form, your details (name, e-mail address, optionally company, content of the message) are stored to handle your enquiry and possible follow-up questions. The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) or my legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). The data is deleted as soon as it is no longer required for this purpose and no statutory retention obligations apply.

Messages from the contact form are delivered to me as e-mail through the sending service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). The form contents are processed on Resend’s servers; where this happens in the USA, the transfer is based on appropriate safeguards under Art. 44 et seq. GDPR (EU standard contractual clauses). A data processing agreement is in place with Resend. The form also contains a hidden field to block automated submissions (spam protection); no additional data is collected for this.

4. Web analytics with PostHog

I use PostHog (provider: PostHog Inc., USA) to analyse how the website is used. Analytics data is processed on servers within the European Union. Technically, the data is transmitted via my own domain (jw-sustainability.com/ingest) to the PostHog servers in the EU. Where data is transferred to the USA, this is based on appropriate safeguards under Art. 44 et seq. GDPR (EU-US Data Privacy Framework or EU standard contractual clauses). PostHog operates in two tiers:

a) Cookieless reach measurement (without consent)

As long as you do not consent, I measure website usage strictly anonymously and without accessing your device. No cookies are set and nothing is stored in your browser. To distinguish visitors, a short-lived identifier is computed server-side from technical connection data (including IP address and browser signature). The random value used for this changes daily and is deleted afterwards, which rules out recognition beyond a single day or across other websites. The legal basis is my legitimate interest in privacy-preserving reach measurement (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR) by emailing jacqueline.wille@jw-sustainability.com.

b) Extended analytics (only with consent)

If you choose “Accept” in the cookie banner, PostHog sets cookies and stores a pseudonymous identifier in your browser to recognise returning visits. In addition, I then record interactions with the page (e.g. clicks and scroll depth) and create session recordings in which form inputs are masked. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer; the analytics cookies set until then are deleted.

5. Google Tag Manager and Google Analytics 4 (only with consent)

Only if you choose “Accept” in the cookie banner is Google Tag Manager loaded, through which Google Analytics 4 is embedded (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics sets cookies (including “_ga”) to evaluate visits and interactions with the website pseudonymously; IP addresses are not stored. Data may be transferred to Google LLC servers in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer; the cookies set until then are deleted and Tag Manager is no longer loaded on the next page view.

6. Cookies and local storage

Without your consent I set no cookies for analytics or marketing purposes and do not read any information from your device. The only technically necessary entries are:

• the entry “analytics-consent” in your browser’s localStorage: it remembers your cookie-banner decision so I do not ask you again;
• the cookie “NEXT_LOCALE”: it stores the language you selected (German or English).

The legal basis is § 25(2) no. 2 TDDDG in conjunction with my legitimate interest (Art. 6(1)(f) GDPR). The analytics cookies described in sections 4 b) and 5 are only added after you have given your consent.

7. Your rights

With regard to the personal data concerning you, you have the following rights against me:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise these rights, simply e-mail jacqueline.wille@jw-sustainability.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Changes to this privacy policy

Last updated: September 2026. I will adapt this policy as soon as the processing on this website or the legal requirements change. The version published here applies.