Information pursuant to Section 5 DDG:

Paul Hebes
Knowledge-based planning
Blankenburger Chaussee 83c
13125 Berlin

Contact:

phone: +49 (0)30 91902603
e-mail: paul.hebes@wissensbasiert.de

We are not willing or obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Notes on the content of this website

The content of this website serves as general information regarding the services, projects and offers of Wissensbasierte Planung. It is created and maintained with professional diligence. Nevertheless, particularly in the case of time-sensitive information or information obtained from external sources, deviations, incompleteness or interim changes cannot be completely ruled out. Sources and dates of data are indicated wherever possible.

For specific services and the use of WBP Solutions, the respective agreed service descriptions and terms of use shall apply. Mandatory statutory liability claims remain unaffected.

We review indications of potential errors or infringements promptly. Affected content is corrected, labeled, or removed as necessary.

Liability for links

Our offer contains links to external websites of third parties, on whose
contents we have no influence, therefore we cannot be held responsible for these external contents.
For the contents of the linked pages the respective provider is always responsible.
The linked pages were created at the time of linking to this website.
possible infringements of the law were checked.
Time of linking not recognizable.

A permanent control of the contents of the linked websites
pages is not reasonable without concrete evidence of a violation of law.
If we become aware of any infringements, we will remove such links immediately.

Copyright

The contents and works created by the site operators on these pages
The duplication, processing, distribution and any other use of such material is prohibited without the
The type of use outside the limits of copyright law requires the written consent of the
Downloads and copies of these pages are only permitted for use by the respective author or creator.
the private, non-commercial use is permitted.

As far as the contents on this page are not
by the operator, the copyrights of third parties are respected.
If you should nevertheless become aware of a copyright infringement, you must notify us immediately.
If we become aware of any violations of the law, please inform us accordingly.
we will remove such contents immediately.

Photos

All images are royalty-free (e.g. from Pixabay) or personally taken, and for images on the Profile page Do the licensing rights lie with Paul Hebes.

1. Controller

Responsible for the processing of personal data on this website and in the WBP Solutions portal is:

Dr Paul Hebes
Knowledge-based planning
Blankenburger Chaussee 83c
13125 Berlin
phone: +49 (0)30 91902603
e-mail: paul.hebes@wissensbasiert.de

2. General Information on Data Processing

We process personal data only to the extent necessary for the provision and security of our website and the WBP Solutions portal, for processing enquiries, for initiating and executing contracts, for billing purposes, or on the basis of consent. Recipients may include the technical service providers named below. Data is not passed on for advertising purposes, nor is advertising profiling carried out within the WBP Solutions portal.

3. Hosting of the main website by STRATO

Our main website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit our website, STRATO processes technically necessary connection data, in particular the IP address, date and time of the visit, the requested address, data volumes transferred, browser and operating system details, as well as status and error messages.

The processing serves the purpose of delivering the website, ensuring stability and security, error analysis, and the detection and defence against attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our website.

According to STRATO, visitors' IP addresses are stored for a maximum of seven days for the purpose of detecting and fending off attacks. The log files provided in the STRATO customer area contain anonymised hostnames or IP addresses and can be accessed there for the past six weeks.

STRATO is used as a data processor on the basis of a contract in accordance with Art. 28 GDPR. Further information can be found in STRATO's data protection information at https://www.strato.de/datenschutz/.

4. Contact

If you contact us by email or telephone, we will process your contact details and the content of your message to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR, insofar as your enquiry is directed towards a contract or the initiation of a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate handling of enquiries. The data will be deleted when the enquiry has been conclusively resolved and there are no statutory retention obligations or legal claims to the contrary.

5. Your rights

Subject to the statutory requirements, you have the right to information, rectification, erasure, restriction of processing, and data portability. Insofar as processing is based on Article 6(1)(f) of the GDPR, you may object on grounds relating to your particular situation. Any consent given may be revoked at any time with effect for the future. To exercise your rights, a message to paul.hebes@wissensbasiert.de is sufficient.

6. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, email: mailbox@datenschutz-berlin.de.

Cookies and similar technologies

On our main website and in the protected WBP Solutions portal, cookies and comparable browser storage methods are used only to the extent described in each case. Technically strictly necessary storage is used in particular for secure login, session management, the provision of explicitly requested functions, and the saving of security or privacy settings. In accordance with Section 25(2) no. 2 of the TDDDG, consent is fundamentally not required for such processes. Data protection processing is carried out on the respective legal bases specified below.

Optional services on the main website, in particular embedded content, are only loaded according to the selection made in the consent manager, provided that consent is required. You can change or revoke your selection at any time via the cookie settings accessible on the website. The lawfulness of the processing carried out up to the point of revocation remains unaffected.

In the protected WBP Solutions portal, no proprietary advertising or reach measurement services are currently in use. A data protection and technical notice regarding the necessary functions appears there. Confirmation of this notice does not constitute consent.

TLS/SSL encryption

This website and the WBP Solutions portal use an encrypted HTTPS connection. This protects transmitted content against unauthorised reading during transit. You can generally recognise an encrypted connection by „https://“ and the padlock symbol in your browser's address bar. Absolute protection of internet-based transmissions cannot be guaranteed.

Use of Real Cookie Banner

We use Real Cookie Banner to manage the cookies and similar technologies used on our main website and the related consents.

During this process, a pseudonymous identifier is assigned to each website visitor. In particular, the selection made, the time of the decision, the banner version used, the settings applicable at that time, as well as technical details and user interactions that led to the consent decision, are processed and documented. The website visitor's IP address is not stored when documenting the consent.

The consent decision stored in the browser is valid for 200 days. After that, the cookie banner is displayed again. A new request can be made earlier if the services used or the configuration of the cookie banner change significantly. The server-side documentation of the consent is deleted after 120 months.

The processing serves to obtain, implement and document consents. The legal bases are Art. 6(1)(c) and (f) GDPR. Our legitimate interest lies in legally compliant and user-friendly consent management. Insofar as information is stored on or read from your terminal device for consent management, this is done on the basis of Section 25(2) no. 2 TDDDG.

You can change or withdraw your selection at any time via the link „Customise cookies and privacy“. Further information on how Real Cookie Banner works can be found at https://devowl.io/de/rcb/datenverarbeitung/.

Use of Cloudflare Web Analytics

Use of Cloudflare Web Analytics

On our main website as well as on other product pages and landing pages operated by Wissensbasierte Planung or for which they are responsible for the content, which link to this privacy policy, we use Cloudflare Web Analytics – provided it is technically integrated there. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

The service processes in particular page views, technical performance metrics, as well as general information on browser, device, operating system, referring page, and country. According to Cloudflare, Cloudflare Web Analytics does not set cookies and does not store identifiers in browser storage for this service; individual users are not to be tracked across different websites.

The processing serves the technical and content-related improvement of our website. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in a data-minimised reach and performance analysis. Cloudflare states that it stores unaggregated beacon data for seven days and provides analyses for up to six months. In the event of a transfer to the USA, the guarantees for international data transfers described by Cloudflare apply. Further information can be found at https://developers.cloudflare.com/web-analytics/ and https://www.cloudflare.com/privacypolicy/.

Embedded Tableau Public dashboards

On our main website, we embed individual publicly accessible dashboards from Tableau Public to showcase examples of our work. Tableau is a Salesforce service. The dashboards are only loaded once you have given your consent to this in the consent manager. When loading, your browser establishes a direct connection with Salesforce/Tableau. In the process, your IP address, browser and device information, content accessed, times and interactions may be processed, and cookies or comparable storage technologies may be set.

Legal bases are your consent pursuant to Article 6(1)(a) of the GDPR and, insofar as information is stored on or accessed from your terminal equipment, section 25(1) of the TDDDG. You can revoke your consent at any time via the cookie settings with effect for the future. Further information can be found under https://www.salesforce.com/de/company/privacy/full_privacy/.

WBP Solutions Portal

1. Offers and user accounts

Under https://portal.wissensbasiert.de we exclusively offer business customers, the self-employed, registered associations, incorporated private-law foundations, public-law legal entities and special public-law funds protected access to digital analysis tools, dashboards, visualisations and reports. There is no public self-registration. The contract is concluded in accordance with the terms of use via an order confirmation from WBP; administrative set-up or activation takes place subsequently or simultaneously.

For orders, contract conclusion, billing and user administration, we process in particular names, business contact details, organisation, ordered services, payment and billing data, as well as the assignment of authorised users. The legal basis is Art. 6(1)(b) GDPR, provided the data subject is the contracting party themselves. If they are acting for a company or another organisation, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the initiation, execution and documentation of the business relationship. We store documents relevant under commercial and tax law in accordance with statutory retention periods.

2. Hosting and portal operations by alwaysdata

The portal, its program logic and the portal database are hosted on the infrastructure of ALWAYSDATA SARL, 91 rue du Faubourg Saint-Honoré, 75008 Paris, France („alwaysdata“). According to the provider, the servers used for the portal are located in France. When accessing the portal, technically necessary connection data is processed, in particular the IP address, date and time, requested address, amount of data transferred, browser and operating system details, referrer as well as status and error messages. This serves the purpose of delivery, stability, error analysis, IT security and the prevention of abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the portal. alwaysdata is used as a data processor pursuant to Art. 28 GDPR.

According to the special contract conditions of alwaysdata for shared hosting, alwaysdata does not store any data about server connections, in particular no IP addresses of the systems accessing the portal. In its current technical design, the WBP Solutions portal does not maintain its own personal access logs at the application level.

3. Authentication with Hanko

For registration, account security and session management, we use Hanko Cloud provided by Hanko GmbH, Ringstraße 19, 24114 Kiel, Germany. Depending on the login method used, this involves the processing of business email addresses, internal user IDs, verification and authentication events, session and security data, and technical connection data in particular. When using a passkey, the private cryptographic key remains on the end device or in the passkey storage used; the associated public key and technical authorisation data are processed.

According to the provider, Hanko processes end-user data on behalf of the respective Hanko Cloud customer on the basis of the Hanko Cloud Data Processing Agreement. The legal basis is Art. 6 (1) (b) GDPR if the data subject is a contracting party themselves, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in secure, user-related access control and in protecting the portal against unauthorised use.

The current project configuration uses a persistent session cookie with a maximum duration of twelve hours. An additional inactivity timeout is not configured. For the session overview, the IP address and user agent are recorded. A maximum of five active sessions are permitted per account; sessions can be revoked. As part of individual login flows, Hanko also uses technically necessary browser storage, including for the flow state, the last used login method and a temporary PKCE verifier. The specific entries are listed in the technical overview below.

Hanko Elements, meaning the visible control component, is versioned and delivered via the portal domain. As a result, retrieving this library does not create an additional connection to a public software CDN. The actual authentication continues to communicate with Hanko Cloud.

The Hanko user account will be maintained for as long as the person concerned holds at least one access authorisation for the WBP Solutions portal. If all portal authorisations are permanently removed, the Hanko user account and the associated authentication data will generally be deleted within 30 days, unless statutory obligations or ongoing security or legal cases require longer retention.

4. Portal permissions and administrative assignments

In the portal database, we store the internal user ID assigned by Hanko, an administrative designation assigned by WBP, the activated tools, the status and validity period of the permissions, and, where applicable, administrative licence details and a username required for Tableau. The portal database does not store passwords or any other Hanko login secrets. In the current technical setup, no separate personal access, security or error logs are maintained at the application level.

Processing is for the performance of the contract, licence control and secure access management. The legal bases are Article 6(1)(b) and (f) of the GDPR. No use is made for advertising profiles. If all portal permissions are permanently removed, the relevant associations are generally deleted within 30 days, unless statutory obligations or ongoing security or legal cases require longer retention.

5. Saved views and tool inputs

Individual tools allow the saving of personal configurations or views. In the protected portal version, this data is assigned to the user account and stored in the portal database. The purpose is to make an explicitly saved configuration available again later. The legal basis is Article 6(1)(b) GDPR for personal contractual partners, otherwise Article 6(1)(f) GDPR. Saved views can be deleted by the user and are removed at the latest when the portal access is deleted, unless legal reasons prevent this.

6. Tableau Cloud

In Tableau-based tools, embedded dashboards are loaded from Tableau Cloud, a service provided by Salesforce. A direct connection is only established when an authorised user opens the relevant tool. In this context, data such as IP addresses, browser and device information, session and security data, accessed views, and interactions with the dashboard may be processed, and technically necessary cookies or browser storage mechanisms may be set. The processing serves the purpose of displaying, authenticating, checking permissions for, and ensuring the stability and security of the booked tool. The legal bases are Article 6(1)(b) and (f) of the GDPR. The specific retention periods within the Tableau environment depend on the current tenant configuration and the contract, data protection, and data processing terms of Salesforce/Tableau.

7. CARTO map tiles

Where a tool uses a map view, the Leaflet map library is delivered locally via the portal domain. However, the background maps themselves are currently loaded from basemaps.cartocdn.com. When a map tile is retrieved, the browser establishes a direct connection to CARTO. For technical reasons, this involves the processing of, in particular, the IP address, time, requested tile, as well as browser and device information. The purpose is to display the map that has been explicitly called up. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the functional display of maps. The operator is CartoDB Inc., based in the USA. For relevant transfers, CARTO cites the EU-U.S. Data Privacy Framework and, additionally, EU Standard Contractual Clauses as transfer mechanisms. Further information can be found at https://carto.com/privacy/.

8. Locally provided libraries

Leaflet, Hanko Elements, the Inter font and Chart.js are version-controlled and served via the portal domain. Fetching these files therefore does not establish a connection to Google Fonts, jsDelivr or any other public library CDN. Locally serving Hanko Elements does not change the fact that authentication uses Hanko Cloud; locally serving Leaflet does not change the fact that the base maps are loaded from CARTO.

9. Recipients and international data transfers

Recipients of personal data are only the internal departments and technical service providers necessary for provision. We conclude contracts with data processors in accordance with Art. 28 GDPR. Insofar as a provider or sub-processor processes data outside the European Economic Area or makes it accessible from there, this only takes place if the legal requirements are met, in particular on the basis of an adequacy decision or the EU Standard Contractual Clauses including any necessary supplementary protection measures.

10. Necessity and automated decisions

The data designated for the contract, user account, authentication and secure provision are required to set up and operate portal access. Without a business email address, user assignment and technically required session data, the protected access cannot be provided. Solely automated decision-making with legal or similarly significant effect does not take place.