Last updated: 30 September 2026
1. Controller
The controller responsible for processing personal data on this website is:
Greenfield Technology AG
Johannstr. 37
40476 Düsseldorf
Phone: 0211 97536647
Email: info@greenfield.ag
Represented by the Executive Board: Nelli Enns (Chairwoman), Lars Ackermann, Dimitri Enns. Further details can be found in our Imprint.
2. General information on data processing
You can visit our website without providing any personal data. We process personal data only to the extent necessary to provide the website, to handle your inquiries, or based on your consent. The legal bases are Art. 6(1)(a) GDPR (consent), (b) (contract or pre-contractual measures), (c) (legal obligation), and (f) (legitimate interest). Access to information stored on your device is additionally governed by Section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG). We store data only for as long as the respective purpose requires, or statutory retention periods require.
3. Hosting and server log files
This website is operated by an external hosting provider that processes data on our behalf. With every visit, the web server automatically stores technically necessary data in log files: IP address, date and time, page requested, amount of data transferred, referrer URL, and browser type and operating system. This processing serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). The log files are deleted once they are no longer required for this purpose.
4. Consent management with Borlabs Cookie
We use the “Borlabs Cookie” plugin by Borlabs GmbH. It requests your consent for services that set cookies or transfer data to third parties, and blocks these services until you agree. Borlabs Cookie runs on our own server. Your visitor data is not transmitted to Borlabs GmbH. For license verification and updates, our server exchanges technical data (domain, plugin version) with Borlabs GmbH.
When you make a selection, we store your decision and the cookie version in a cookie (borlabs-cookie). The storage period is 183 days. To document your consent, we log a pseudonymous identifier, your selection, and the time in our database. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, as well as Section 25(2) No. 2 TDDDG. The log is automatically deleted after 14 months.
You can change or revoke your selection at any time with effect for the future. To do so, use the cookie icon at the edge of the screen or the privacy preferences in the banner.
5. Google Analytics 4
With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For users outside the EEA and Switzerland, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is responsible. Google Analytics sets cookies (_ga, _ga_*, stored for up to two years) and records events such as page views, time on page, visitor origin, device, and approximate location. Google Analytics 4 does not store IP addresses.
We use Google Consent Mode. Without your consent, the Google script is not loaded and no cookies are set. If you consent, analytics tracking is enabled. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Any transfer to the USA is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, to which Google LLC is certified. Event and user data in our Google Analytics account is automatically deleted after 14 months. Independently of this, Google anonymizes or deletes certain data in its own systems on fixed schedules, for example parts of IP addresses in advertising server logs after 9 months and cookie information after 18 months (Google’s data retention information). Further information: https://policies.google.com/privacy.
You can withdraw your consent at any time via the privacy preferences (see Section 4).
6. Google Fonts
Our website uses fonts from Google Fonts. They are loaded from Google Ireland Limited’s servers only after your consent (category “External Media”). In doing so, Google receives your IP address and the information that you have visited our website. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it via the privacy preferences.
7. Getting in touch (email, phone, contact form)
If you contact us by email or phone, or use the contact form, we process the information you provide (first name, last name, email address, message) to handle your inquiry. The form sends your details to us by email. It does not store them in the website database. The legal basis is Art. 6(1)(b) GDPR where your inquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. By checking the box in the form, you confirm that you have read this privacy policy. We delete your inquiry once it has been fully processed and no statutory retention periods apply.
8. Careers and job postings (Personio)
On our careers page, we display open positions. Our server retrieves the list as public job data (title, employment type, working-time model) from Personio and caches it for 30 minutes. No data about website visitors is transmitted to Personio in the process.
If you click on a position, the job listing opens on Personio’s website in a new window (greenfieldtechnology.jobs.personio.com). From that point on, Personio SE & Co. KG, Munich, processes your data as the provider of the applicant-management system. Personio’s own privacy notices, together with our notices in the application process, apply to applications submitted via Personio. If you reach our careers page through a link carrying a channel identifier (the channel parameter), we pass this identifier on to the Personio link so that the source of the application can be evaluated.
9. Website security (Wordfence)
To protect against attacks and abuse, we use the security plugin “Wordfence Security” by Defiant Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. It protects the login area and blocks suspicious access attempts. In doing so, it stores on our server the IP address, requested URL, browser identifier, referrer, and timestamp of blocked or suspicious requests as well as of login attempts. Wordfence automatically purges these logs on a regular basis.
We also block access from certain countries. For this purpose, each visitor’s IP address is matched to a country of origin. In addition, we participate in the Wordfence network: information about detected attacks, in particular the IP address and the requested URL, is transmitted to Wordfence’s servers in the USA and compared there against known attack patterns. IP addresses may also be queried there for the purpose of determining location.
The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in the security of our website. For the transfer to the USA, we rely on the European Commission’s Standard Contractual Clauses provided by Defiant (Art. 46(2)(c) GDPR); see Wordfence and GDPR. Wordfence sets cookies only for users with a user account. The login area is intended for administrators only and may be protected by Google reCAPTCHA.
10. External links
Our website contains links to other websites, for example to our LinkedIn profile. No data is transmitted to these providers unless you click on the links. After that, the respective provider’s privacy notices apply.
11. Your rights
You have the right, with respect to us, to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). To do so, please contact us using the details given above.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information, Kavallerießtraße 2-4, 40213 Düsseldorf.
12. Obligation to provide data, automated decision-making
Providing your data is neither legally nor contractually required. However, without the information requested in the contact form, we cannot process your inquiry. No automated decision-making, including profiling, takes place.
13. Currency of this policy
Last updated: 30 September 2026. We update this policy whenever our services or the applicable legal requirements change.
