https://wonnda.com/assets/privacy-policy-CoqXEfp1.js

1import{j as e,P as t,e as o,h as a,bo as n}from"./index-495Gbj5S.js";const r=`Last updated: 27 August 2026
2
3This policy explains how Wonnda GmbH processes personal data on our website (wonnda.com), our
4sourcing platform (app.wonnda.com) and our help centre (help.wonnda.com).
5
6---
7
8## 1. Controller and contact
9
10The controller within the meaning of Art. 4(7) GDPR is:
11
12**Wonnda GmbH**
13Klosterstraße 65, 10179 Berlin, Germany
14Phone: +49 30 16634706
15Email: [email protected]
16
17For all questions about data protection, and to exercise the rights described in sections 13 and
1814, write to [email protected].
19
20For the Meta Pixel described in section 7 we are a joint controller with Meta within the meaning
21of Art. 26 GDPR.
22
23---
24
25## 2. Data we process
26
27- **Account data** — name, business email address, sign-in credentials or magic-link token, job title, language and notification preferences, profile photo.
28- **Company data** — company name, address, country, website, VAT ID, logo and media, categories, certifications, production capabilities, minimum order quantities.
29- **Sourcing content** — the requests you post, product catalogues you upload or import, newsfeed posts, ratings, and attached files and images.
30- **Messages** — the content of chats with other companies, including attachments and voice notes recorded in the message composer.
31- **Enquiries** — what you send us through our contact page, by email, or when you request gated content such as a download.
32- **Technical data** — IP address, browser and device type, operating system, language, referrer, timestamps, error diagnostics.
33- **Usage data** — pages viewed, features used, requests opened, matches accepted or declined, email opens and clicks.
34- **Billing data** — plan, invoices, payment status. Card details are entered directly with our payment provider and never reach our servers.
35
36For supplier companies that do not yet have an account, we also process business information from
37public sources — see section 10. If you apply for a job with us, see section 11.
38
39---
40
41## 3. Purposes and legal bases
42
43| Purpose | Legal basis |
44| --- | --- |
45| Creating and running your account; signing you in by magic link or password | Art. 6(1)(b) GDPR — performance of a contract |
46| Publishing your requests, matching you with counterparties, delivering chats, notifications and transactional email | Art. 6(1)(b) GDPR |
47| Disclosing your request, profile and messages to the counterparty you deal with (section 6) | Art. 6(1)(b) GDPR |
48| AI features that draft, summarise, classify or transcribe the content you enter (section 6) | Art. 6(1)(b) GDPR |
49| Handling enquiries you send us through the contact page, by email, or when requesting gated content | Art. 6(1)(b) GDPR where it concerns a contract, otherwise Art. 6(1)(f) — our interest in answering you |
50| Digests of relevant new requests, which you can switch off in your settings | Art. 6(1)(f) GDPR — our legitimate interest in an active marketplace |
51| Subscriptions, invoicing and dunning | Art. 6(1)(b) GDPR; retention under Art. 6(1)(c) with §§ 147 AO, 257 HGB |
52| Vetting new registrations; spam, fraud and duplicate-account screening | Art. 6(1)(f) GDPR — protecting the marketplace and its users |
53| Providing the website and keeping it secure and available, including server logs | Art. 6(1)(f) GDPR — a secure and functioning service |
54| Error monitoring and abuse prevention | Art. 6(1)(f) GDPR — a secure and functioning service |
55| Maintaining our supplier directory from public sources (section 10) | Art. 6(1)(f) GDPR — a complete and accurate B2B directory |
56| Product analytics and masked session replay in the app | Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent |
57| Reach measurement and advertising on wonnda.com (section 7) | Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent |
58| Responding to legal claims, audits and authority requests | Art. 6(1)(c) and Art. 6(1)(f) GDPR |
59
60Where we rely on legitimate interests, you may object at any time — see section 14.
61
62---
63
64## 4. Whether you have to provide data
65
66You are not required by law to give us any data. Account and company data are, however, necessary
67to enter into and perform the contract with us: without them we cannot create an account, publish
68your requests, or connect you with a counterparty. Everything else — a profile photo, capability

69details, analytics consent — is voluntary, and declining has no consequence for your use of
70Wonnda.
71
72---
73
74## 5. Cookies and device storage
75
76We store information on your device, or read information from it, only where that is strictly
77necessary to provide the service you requested (§ 25(2) TDDDG), or where you have consented
78(§ 25(1) TDDDG). Consent is asked separately on the website and in the app, and can be changed at
79any time with effect for the future.
80
81### Strictly necessary — no consent required
82
83| Stored item | Purpose | Duration |
84| --- | --- | --- |
85| Session and authentication cookie | Keeps you signed in and protects the session | Until you sign out, at most 30 days |
86| CSRF token | Protects forms against cross-site request forgery | For the session |
87| Consent cookie | Records your cookie decision so we do not ask again and can prove the choice | 12 months |
88| Theme setting (local storage) | Remembers light or dark mode | Until you clear your browser storage |
89| \`__cf_bm\` (Cloudflare) | Distinguishes humans from bots | 30 minutes |
90
91### With your consent
92
93**In the app (app.wonnda.com)** — product analytics and session replay through PostHog, stored on
94your device for up to 12 months. All text and all form inputs are masked in the browser before
95anything is transmitted: the recording shows layout and interaction, not what you typed or read.
96Declining also records a durable objection on your account, so the choice applies on your other
97devices. You can change it under **Settings → Account → Cookie preferences**.
98
99**On wonnda.com** — reach measurement and advertising tags loaded through Google Tag Manager:
100Google Analytics 4, Google Ads conversion tracking and the Meta Pixel. These set identifiers on
101your device for up to 24 months and allow the providers named in sections 6 and 7 to recognise
102your browser across visits and, for Meta, across its own platforms. They are used only with your
103consent, which you can give, refuse or withdraw at any time using the privacy button at the bottom
104left of the page.
105
106---
107
108## 6. Recipients
109
110The following service providers process personal data on our instructions under data processing
111agreements pursuant to Art. 28 GDPR. Locations refer to where the data is processed for us. The
112advertising providers in section 7 are not processors — that relationship is described separately.
113
114### Hosting and infrastructure
115
116| Recipient | Purpose | Location |
117| --- | --- | --- |
118| Vercel | Hosting and execution of app.wonnda.com | Frankfurt (fra1); provider established in the USA |
119| Lovable Cloud | Database, file storage and realtime messaging | AWS eu-central-1, Frankfurt |
120| Lovable Labs | Hosting and server-side execution of wonnda.com and help.wonnda.com | Global edge network via Google Cloud and Cloudflare; provider established in Sweden |
121| Cloudflare | DNS, content delivery and attack protection | Global edge network |
122| Notion | Hosting of our careers page | USA |
123
124### Communication
125
126| Recipient | Purpose | Location |
127| --- | --- | --- |
128| Resend | Delivery of transactional email and delivery events from our own domain | Ireland (eu-west-1); provider established in the USA |
129| Customer.io | Onboarding and lifecycle email | EU region |
130| Slack | Internal operational alerts that can contain your name, email address and company | USA |
131| Browser push services | Delivery of push notifications you enabled, through Google, Apple, Mozilla or Microsoft | Depends on your browser |
132
133### Analytics and monitoring
134
135| Recipient | Purpose | Location |
136| --- | --- | --- |
137| PostHog | Consent-based product analytics and masked session replay | EU cloud, Frankfurt |
138| Sentry | Error and performance monitoring, configured without IP addresses or request bodies; with your consent also session replay | EU region, Germany |
139| Segment, Mixpanel | Routing and analysis of product events | USA |
140| Vercel Analytics and Speed Insights | Aggregate performance measurement without cookies or cross-site identifiers | Frankfurt |
141| Google Ireland Ltd. (Google Analytics 4) | Consent-based reach measurement on wonnda.com | Ireland, with onward transfer to Google LLC, USA |
142| Usercentrics | Consent management on wonnda.com; stores your consent decision as proof | Germany |
143
144### PostHog
145
146We use PostHog (PostHog Inc., hosted in the EU) to understand how our web application is used:
147which pages are visited, where people click, and anonymised recordings of sessions in the
148application.
149
150Session recordings are masked before they leave your browser. All text content and all form inputs
151are replaced with placeholders, so the recording shows the structure of a page and how it was
152navigated, never what was written or read. We do not record message contents, request details, or
153anything you type.
154
155PostHog only runs if you have accepted analytics cookies. If you decline, or choose "Only
156essential", PostHog is not loaded at all and no recording takes place.
157
158Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
159
160### What our analytics never contain
161
162Our analytics record that an action happened and what kind of action it was. They do not record
163what you wrote.
164
165Specifically, the following never reach any analytics provider:
166
167- the contents of messages you send or receive,
168- the text of sourcing requests, product descriptions, posts, or reviews,
169- the search terms you enter.
170
171Where we need to understand how a feature is used, we record structural information instead of
172content. A search, for example, is recorded as the length of the query and the number of results it
173returned, never the query itself.
174
175Business contact details such as your name, email address, phone number, and company name are
176transmitted to the providers named above so that your account can be recognised across sessions.
177These are contact details, not content.
178
179### AI providers
180
181| Recipient | What we transmit | Location |
182| --- | --- | --- |
183| OpenAI | Request and product text, chat messages sent to our in-app assistant, uploaded catalogue files, voice notes for transcription, and content generated or edited in our internal tools | USA |
184| Google | Request and supplier profile data for matching, prompts for generated imagery, and content generated or edited in our internal tools | USA |
185| Perplexity | Company names and public web queries about them | USA |
186
187These providers act as processors and are contractually barred from using the transmitted content
188to train their models. Voice notes are passed through for transcription and are not stored by us.
189
190### Business operations
191
192| Recipient | Purpose | Location |
193| --- | --- | --- |

194| Stripe | Subscription payments; card data is entered directly with Stripe | EU and USA |
195| HubSpot | CRM for sales and account management | EU (eu1) |
196| Firecrawl, Apollo.io | Collection and enrichment of public supplier information (section 10) | USA |
197
198We also disclose data to tax advisers, auditors and authorities where we are legally required to,
199and to lawyers where necessary to establish or defend legal claims.
200
201### Other users of the platform
202
203Wonnda is a marketplace, so part of what you enter is disclosed to the companies you deal with.
204This happens to perform our contract with you (Art. 6(1)(b) GDPR). Those companies are separate
205controllers for what they do with the data afterwards, and their own privacy policies apply.
206
207- Your company profile is visible in the directory, and to search engines where the profile is public.
208- Your requests are visible to matching suppliers. If you post incognito, your company name stays hidden and your contact details are disclosed only once you accept a match.
209- Everything you write in a chat, and every file you attach, is visible to the other company and to their colleagues on the same company account.

210- Sharing a request or inviting a colleague discloses your name and the content to the recipient.
211- Ratings you submit are shown with your company name.
212
213---
214
215## 7. Joint controllership with Meta
216
217Where you consent to the Meta Pixel on wonnda.com, we are a **joint controller** with Meta for the
218collection of the data on our website and its transmission to them, within the meaning of
219Art. 26 GDPR:
220
221- **Meta Platforms Ireland Ltd.**, Merrion Road, Dublin 4, Ireland — Meta Pixel. Joint controllership is governed by the Controller Addendum at <https://www.facebook.com/legal/controller_addendum>; information on the processing is at <https://www.facebook.com/privacy/policy>.
222**The essence of this arrangement:** we are responsible for obtaining your consent and for
223informing you, which is what this section does. Meta is responsible for everything that happens
224after the data reaches it — the security of that processing, and answering your requests
225about it. Data is processed further by Meta for its own purposes, including profiling for
226advertising, which we cannot influence and to which we have no access at the level of an
227identified person.
228
229You may exercise your rights under Arts. 15 to 22 GDPR against us or against Meta directly.
230Requests that concern Meta's own processing can only be answered by Meta, and we will forward such
231requests. The most effective way to stop this processing entirely is to withdraw
232your consent using the privacy button at the bottom left of any page.
233
234**Google Ads** works differently. With your consent we transmit conversion and remarketing data to
235**Google Ireland Ltd.**, Gordon House, Barrow Street, Dublin 4, Ireland, which processes it as an
236independent controller for its own purposes rather than jointly with us. The legal basis for our
237transmission is your consent under Art. 6(1)(a) GDPR; what Google does afterwards is governed by
238<https://policies.google.com/privacy>. Google Analytics, by contrast, runs as a processor on our
239instructions and is listed in section 6.
240
241---
242
243## 8. Transfers outside the EEA
244
245Our database, file storage, transactional email, error monitoring, product analytics and CRM are
246located in the EU where listed in section 6. wonnda.com and help.wonnda.com are served through a
247global edge network, so website hosting and security processing can take place at network locations
248outside the EEA. The recipients marked USA in section 6, and the onward transfers described in
249section 7, involve processing outside the EEA.
250
251Those transfers are safeguarded either by the recipient's certification under the EU–US Data
252Privacy Framework, which the European Commission has recognised as providing an adequate level of
253protection (Art. 45 GDPR), or by the European Commission's Standard Contractual Clauses together
254with supplementary technical and organisational measures (Art. 46(2)(c) GDPR). Despite these
255safeguards, US public authorities may in principle be able to access data held by US providers,
256and effective legal remedies against this may be limited.
257
258You can request a copy of the safeguards, including which mechanism applies to which recipient,
259at [email protected].
260
261---
262
263## 9. Automated decisions and profiling
264
265Three checks in the platform run automatically before a person is involved:
266
267- **Company review.** New registrations are scored against public information about the company and the plausibility of the profile. A clear result can approve an account without delay; anything doubtful goes to a member of our team.
268- **Request review.** New sourcing requests are checked for spam, duplicates and completeness before publication.
269- **Matching.** Requests and supplier profiles are compared to decide which suppliers see a request, and in what order. This involves profiling within the meaning of Art. 4(4) GDPR, based on the categories, capabilities and activity recorded in your company profile.
270
271**We do not take decisions producing legal effects concerning you, or similarly significantly
272affecting you, solely by automated means** within the meaning of Art. 22(1) GDPR. An automated
273check never results in a rejection on its own: every negative outcome is reviewed by a person
274before it takes effect. You can ask for that review, state your position and contest the decision
275at [email protected]. We do not use these scores to assess creditworthiness and we do not pass
276them on.
277
278---
279
280## 10. Data from public sources
281
282Our supplier directory contains company profiles created before the company registered with us. If
283you are a contact person at such a company, this section is the information we owe you under
284Art. 14 GDPR.
285
286- **Categories of data:** company name, address and country, website, business email address and phone number, production capabilities, certifications, product categories, company size, and the name and job title of a business contact where these are published.
287- **Sources:** the company's own website and public pages, retrieved through our processor Firecrawl; public business registers and trade-show directories; and the B2B data provider Apollo.io. All sources are publicly accessible.
288- **Purpose and legal basis:** maintaining a complete and accurate supplier directory and matching it against buyer requests, on the basis of our legitimate interest in a functioning B2B marketplace under Art. 6(1)(f) GDPR. We process data relating to your professional role, not your private life.
289- **Recipients:** the providers named in section 6.
290- **Retention:** until you object; profiles with no contact for 24 months are reviewed and deleted.
291
292Because we usually have no reliable way to reach the individual contacts behind these company
293records, notifying each one would involve disproportionate effort within the meaning of
294Art. 14(5)(b) GDPR. We therefore make this information publicly available here, and provide it
295directly at the latest when we first communicate with you.
296
297You can object at any time, without giving reasons, at [email protected]. We then delete the
298profile and record the domain so that it is not collected again. On request we also tell you which
299field came from which source.
300
301---
302
303## 11. Applications for employment
304
305If you apply to work with us, we process the data in your application — contact details, CV,
306references, and anything else you send — solely to decide on your application, on the basis of
307§ 26(1) BDSG and Art. 6(1)(b) GDPR. Applications are visible only to the people involved in the
308decision.
309
310If we do not hire you, we delete your application six months after the process ends, which covers
311the period for claims under the AGG. If you agree, we keep it for up to a further twelve months so
312we can approach you about other roles;

312 that consent is voluntary and can be withdrawn at any time.
313If we do hire you, the data moves into your personnel file.
314
315---
316
317## 12. How long we keep data
318
319We keep personal data for as long as it is needed for the purpose it was collected for, unless a
320statutory retention period requires longer.
321
322| Data | Period |
323| --- | --- |
324| Account and company profile | For the duration of the account; deleted within 30 days of a deletion request, backups within a further 90 days |
325| Requests, catalogues, posts, ratings | Deleted or anonymised together with the account; ratings remain visible without your name |
326| Chats and messages | For the duration of the account. Messages already sent remain in the counterparty's business record, attributed to a deleted user |
327| Enquiries through the contact page or by email | 6 months after the matter is closed, unless it becomes part of a contract |
328| Invoices and payment records | 10 years (§ 147 AO, § 257 HGB) |
329| Business correspondence relevant to a contract | 6 years (§ 257 HGB) |
330| Server and access logs | 30 days |
331| Error reports and performance data | 90 days |
332| Product analytics events | 24 months |
333| Session replay recordings | 30 days |
334| Email delivery events | 12 months |
335| Push notification subscriptions | Until you disable notifications or the browser endpoint expires |
336| Consent and objection records | 3 years after the decision or its withdrawal, as evidence |
337| Suppression lists for unsubscribes and objections | Indefinitely, in minimised form, so that we do not contact you again |
338| Applications for employment | See section 11 |
339| Directory profiles from public sources | See section 10 |
340
341---
342
343## 13. Your rights
344
345You have the right to:
346
347- **Access** your personal data and receive a copy (Art. 15 GDPR).
348- **Rectification** of inaccurate or incomplete data (Art. 16 GDPR). Most of it you can correct yourself in your settings.
349- **Erasure** (Art. 17 GDPR). You can request deletion under **Settings → Account** or by email; we delete or anonymise your data within 30 days, except where a period in section 12 requires otherwise.
350- **Restriction** of processing (Art. 18 GDPR).
351- **Data portability** — the data you provided, in a structured, commonly used and machine-readable format (Art. 20 GDPR).
352- **Withdraw consent** at any time with effect for the future (Art. 7(3) GDPR), without affecting processing already carried out.
353
354### How to exercise your rights
355
356Write to [email protected]. We respond within one month and may ask for information to verify
357your identity. Exercising a right is free of charge.
358
359### Right to lodge a complaint
360
361You may lodge a complaint with a supervisory authority, in particular in the member state of your
362residence, place of work or of the alleged infringement. The authority responsible for us is the
363Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
364
365---
366
367## 14. Your right to object — Art. 21 GDPR
368
369**Where we process your personal data on the basis of a legitimate interest under Art. 6(1)(f)
370GDPR, you have the right to object at any time, on grounds relating to your particular situation,
371to that processing.** This applies in particular to the request digests, the screening of new
372registrations, our server logs and error monitoring, and the supplier profiles built from public
373sources described in section 10.
374
375If you object, we will no longer process the data concerned unless we can demonstrate compelling
376legitimate grounds that override your interests, rights and freedoms, or the processing serves to
377establish, exercise or defend legal claims.
378
379**Where personal data is processed for direct marketing, you may object at any time without giving
380reasons.** After such an objection the data will no longer be used for that purpose.
381
382An objection is free of form and free of charge. Send it to [email protected]. Declining the
383analytics banner in the app is also treated as an objection and is recorded on your account.
384
385**Objecting to analytics.** You can object to analytics at any time, with no reason required, and
386we will stop processing your data for this purpose.
387

388The quickest way is in the application itself: **Settings → Account → Privacy & cookies**, where
389"Turn analytics off" applies to your account. Choosing "Only essential" in the cookie banner has
390the same effect.
391
392An objection made this way applies to your whole account, not just the browser you made it in. It
393survives clearing your cookies and applies on every device you sign in from. It takes effect
394immediately: once recorded, no further analytics events or profile updates are sent for you, and no
395profile is created for you at any of the providers named above.
396
397You can also object by writing to [email protected], and you can switch analytics back on at any
398time from the same settings page.
399`,i=n(r);function c(){return e.jsxs("article",{className:"bg-bg",children:[e.jsx(t,{eyebrow:"LEGAL",crumbs:[{label:"Home",to:"/"},{label:"Privacy Policy"}],title:"Privacy Policy",lead:"How Wonnda processes personal data when you use our website and B2B sourcing platform."}),e.jsx(o,{children:e.jsx(a,{className:"[&_h2]:mt-10 [&_h2]:font-display [&_h2]:text-xl [&_h2]:font-semibold [&_h2]:text-fg [&_h3]:mt-8 [&_h3]:font-display [&_h3]:text-base [&_h3]:font-semibold [&_h3]:text-fg [&_ul]:list-disc [&_ul]:pl-5 [&_ul]:space-y-2 [&_ol]:list-decimal [&_ol]:pl-5 [&_ol]:space-y-2 [&_a]:underline [&_a]:underline-offset-2 [&_a]:text-fg [&_hr]:my-8 [&_hr]:border-border [&_table]:w-full [&_table]:my-6 [&_table]:border-collapse [&_table]:text-sm [&_th]:border [&_th]:border-border [&_th]:bg-[var(--w-accent-soft)] [&_th]:p-2 [&_th]:text-left [&_th]:font-semibold [&_th]:text-fg [&_td]:border [&_td]:border-border [&_td]:p-2 [&_td]:align-top",children:e.jsx("div",{className:"space-y-4 [&>*:first-child]:mt-0",dangerouslySetInnerHTML:{__html:i}})})})]})}export{c as component};