1. Introduction
1.1 Scope of application
Data protection is a top priority for us. PAVANA GmbH processes your personal data exclusively within the framework of the applicable data protection laws, in particular the General Data Protection Regulation (GDPR). In the following, we inform you about the mode, scope and purposes of the processing of your personal data in ac-cordance with Art. 13 GDPR. This privacy policy applies to the processing of per-sonal data when you use our website, when you contact us via other forms of com-munication and when your data is processed in the processes of customer admin-istration, contact management, and project management. The table of contents al-lows you to easily find basic information about the data processing activities carried out and relevant to you. If you have any questions, please do not hesitate to contact us.
 

1.2 Controller
The controller within the meaning of the data protection regulations for the pro-cessing of personal data is:

PAVANA GmbH
Otto-Hahn-Str. 12–16, 25813 Husum
Further contact information can be found in the provider identification ('Legal Notice') of this website.

1.3 Data protection officer
You can reach our company data protection officer at
PAVANA GmbH
Company data protection officer
Otto-Hahn-Str. 12–16
D-25813 Husum
Email: datenschutz(at)pavana-wind.com
 

2. Definitions of terms
In this privacy policy, we use certain terms that also appear in the General Data Pro-tection Regulation (GDPR). For a better understanding, we are providing explana-tions of the terms used below.:
 

2.1 Personal data
Personal data means any information relating to an identified or identifiable natural person. A person is considered identifiable if they can be directly or indirectly identified - for example, by reference to a name, an identification number, location data, an online identifier (such as IP addresses or cookies) or specific characteristics that reflect the physical, physiological, genet-ic, mental, economic, cultural or social identity of that person.
 

2.2 Processing
The term processing refers to any activity involving the handling of personal data. This in-cludes all processes – regardless of whether they are automated or not. Examples include the collection, storage, modification, use, transmission, publication, erasure or destruction of data.
 

2.3 Controller
A controller is a natural or legal person, public authority, organisation or other body which, alone or jointly with others, determines the purposes and means of the pro-cessing of data. The controller must take appropriate organisational and technical measures to ensure that the processing of personal data complies with legal re-quirements and is regularly reviewed.
 

2.4 Processor
A processor is a person, organisation, authority or other body that processes per-sonal data on behalf of the controller. The processor acts on the basis of the control-ler's instructions.
 

2.5 Recipient
The recipient is any natural or legal person, public authority or other body to whom personal data is disclosed. This applies regardless of whether it is a third party or not. However, authorities that request personal data as part of statutory investigation mandates are not considered recipients under data protection law.
 

2.6 Third party
A third party is any natural or legal person, public authority or body other than the data subject, the controller or the processor. Persons who are authorised to process data under the direct supervision of the controller or a processor are also not con-sidered third parties.
 

2.7 Consent
Consent is a central element of self-determination under data protection law. It rep-resents the voluntary and conscious consent of the data subject to have their per-sonal data processed. Consent must be given unambiguously - either in the form of a written declaration or by another confirmatory act. Any consent given can be with-drawn at any time.
 

3. General information on data processing

3.1 Scope of the processing of personal data
Personal data is information about your identity. This includes, for example, infor-mation such as name, address, telephone number or email address. We process the personal data of our interested parties, customers and suppliers only to the extent necessary to provide a functional website or to offer our services. As a rule, such data is processed if the data subject has given their prior consent. However, person-al data may also be processed on other legal bases.
 

3.2 Legal bases for the processing of personal data
Personal data is only processed on the basis of a valid legal basis in accordance with the EU General Data Protection Regulation (GDPR):

• If a data subject has consented to the processing of personal data, the pro-cessing is based on Art. 6 (1) (a) GDPR.
• In the case of processing operations that are necessary for the initiation or fulfilment of a contract to which the data subject is party, we rely on Art. 6 (1) (b) GDPR.
• If the processing is necessary on the basis of a legal obligation to which we are subject, Art. 6 (1) (c) GDPR forms the legal basis.
• In cases where vital interests of the data subject or another natural person re-quire processing, this is done on the basis of Art. 6 (1)  (d) GDPR.
• If the processing is based on our legitimate interest, whereby the interests, fundamental rights and freedoms of the data subject do not prevail, Art. 6 (1) (f) GDPR serves as the basis for data processing.
 

We will inform you at the relevant points in this privacy policy of the legal basis on which your personal data is processed.
 

3.3 Storage and erasure of personal data
Personal data will be erased or blocked as soon as the purpose for which it was col-lected no longer applies. Any further storage will only take place if it is required by legal provisions of the European Union or national law to which we are subject. If legally stipulated storage periods expire, the data will also be erased or blocked, un-less its further storage is necessary for the fulfilment of a contract or for the imple-mentation of pre-contractual measures.
 

3.4 Disclosure of personal data
Your personal data will only be passed on to third parties if this is necessary for the purpose of carrying out the data processing set out below or if you have previously consented to the transfer. We only disclose personal data about interested parties, customers or suppliers if we are obligated to do so by law or by a court order or if the disclosure is necessary to enforce or protect our contractual obligations. This also applies accordingly with regard to the storage of data. The data is not disclosed for commercial purposes.

For certain processing activities, we use external service providers that we select with due care. If personal data is transferred to these service providers as part of so-called order processing, this is done in accordance with the requirements of Art. 28 GDPR. Our processors are contractually bound by our instructions and are regularly monitored by us. We only work with partners who are demonstrably able to meet the requirements of the GDPR and the Federal Data Protection Act (BDSG) and ensure the protection of your rights through suitable technical and organisational measures. Our processors or other third parties may not use the data for other pur-poses. Our employees and the employees of the companies commissioned by us are committed by us to maintain confidentiality.
 

3.5 Data transfer to third countries
The General Data Protection Regulation (GDPR) ensures a uniformly high level of data protection within the European Union. Therefore, when selecting our service providers and co-operation partners, we generally prefer European providers if the processing of your personal data is necessary. Processing outside the European Union or the European Economic Area only takes place in exceptional cases and in connection with the use of third-party services.
Processing of your data in a so-called third country is only permitted on condition that the strict requirements of Art. 44 et seq. GDPR are fulfilled. As a rule, we obtain your express consent for this in accordance with Art. 49 (1) (a) GDPR. Alternatively, processing can be carried out on the basis of special guarantees. Such guarantees can be, for example, an officially recognised equivalence of the level of data protec-tion by the EU Commission, as guaranteed by the Data Privacy Framework (DPF), or the application of so-called 'standard contractual clauses', which are officially rec-ognised contractual obligations.
 

3.6 Profiling and automated decision-making
At PAVANA GmbH, personal data is neither used for automated decision-making nor for profiling in accordance with Art. 22 GDPR.
 

4. Rights of data subjects
You have the right to receive information about the origin, recipient and purpose of personal data stored concerning you free of charge and at any time. You also have the right to request the rectification, blocking or erasure of this data. You can contact us at any time if you have further questions on the subject of data privacy. You also have the right to lodge a complaint with the competent supervisory authority.
 

4.1 Right of access
In accordance with Art. 15 GDPR, you have the right to obtain information on the personal data concerning you, its origin and recipients and the purpose of the data processing, free of charge and at any time .

4.2 Right to rectification
If your data is not (or no longer) correct, you can request a rectification in accord-ance with Art. 16 GDPR. If your data is incomplete, you can request that it be com-pleted. If we have passed on your data to third parties, we will inform these third par-ties of the rectification - if this is required by law.
 

4.3 Right to erasure
The stored personal data will be erased in accordance with Art. 17 GDPR after expiry of the statutory retention periods. Stored personal data will also be erased if you withdraw your consent to storage and there is no other legal basis for the storage, if knowledge of the data is no longer required to fulfil the purpose for which it was stored or if its storage is inadmissible for other legal reasons, unless statutory reten-tion requirements prevent erasure, in which case processing will be restricted (blocked) instead of erased.

Stored personal data will also be erased if your personal data has been processed unlawfully or must be erased in order to comply with legal requirements. In the event that erasure cannot be realised or can only be realised with disproportionate effort, processing shall be restricted instead of erased.
 

4.4 Right to restriction of processing
You have the right to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR. You can contact us at any time for this purpose. The right to restriction of processing  applies in the following cases:

•    If you dispute the accuracy of your personal data stored by us, we usually need time to check this. While the check is ongoing, you have the right to re-quest that the processing of your personal data be restricted.
•    If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.
•    If we no longer need your personal data, but you need it for the exercise, de-fence or assertion of legal claims, you have the right to request the restriction of the processing of your personal data instead of its erasure.
•    If you have lodged an objection in accordance with Art. 21 (1) GDPR, your in-terests must be weighed against ours. As long as it has not yet been deter-mined whose interests prevail, you have the right to demand the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or le-gal person or for reasons of important public interest of the European Union or of a Member State.
 

4.5 Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw any consent you have already given at any time in accordance with Art. 7 (3) GDPR. All you need to do is to notify us by sending an informal email. The lawfulness of the data processing carried out until its withdrawal remains unaffected by the withdrawal.
 

4.6 Right to object to the collection of data
If the data processing is carried out on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing of your personal data at any time in accordance with Art. 21 GDPR for reasons arising from your particular situation. If you lodge an ob-jection, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is required for the establishment, exercise or defence of legal claims.
 

4.7 Objection to advertising emails
We hereby object to the use of contact data published in the context of the imprint obligation to send unsolicited advertising and information material. Pavana GmbH expressly reserves the right to take legal action in the event of the unsolicited send-ing of advertising material, such as spam emails.
 

4.8 Right to data portability
In accordance with Art. 20 GDPR, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract provided to you or to a third party in a common, machine-readable format. If you request the di-rect transfer of the data to another controller, this will only be done to the extent that it is technically feasible.
 

4.9 Right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work or place of the alleged violation. The right to lodge a complaint exists notwithstanding other administrative or judicial rem-edies.

A list of data protection officers and their contact details can be found at the follow-ing link: www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html
 

5. Online offers

5.1 Visits to our website
Purpose of data processing and data categories
If you only use the website for information purposes, i.e. if you do not transmit any other information to us, only the personal data that your browser transmits to the server will be processed when you visit this website. The data collected is used ex-clusively to provide and improve the content and functionality of our websites. 

When you visit our website, information is transmitted that we need in order to dis-play and provide you with our webpages, such as

•    Browser type/version
•    The current IP address of the Internet connection you are using
•    Operating system you are using
•    Referrer URL (the previously visited page)
•    Date and time of the server request

As a rule, this data cannot be assigned to a specific person; it is not merged with other data sources.
 

Legal basis for data processing
The legal basis for the processing of personal data is Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in the secure, stable and efficient provision of the func-tions of the website and the information that can be accessed via it. If we fulfil an existing contractual obligation towards you by providing the website, the legal basis is Art. 6 (1) (b) GDPR.
 

Duration of storage
The data collected will be erased after a statistical analysis at the end of the session.
 

Disclosure of data to third parties
This data will not be passed on to third parties unless there is a legal obligation to pass it on or it serves the purpose of criminal prosecution.
 

5.2 Contact form
Purpose of data processing and data categories
If you send us enquiries via the contact form, your details from the enquiry form, in-cluding the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We do not pass on this data without your consent.

Legal basis for data processing

This data is processed on the basis of Art. 6 (1) (b) GDPR, provided that your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 (1)  f GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this has been requested.
 

Duration of storage
We will retain the data you provide on the contact form until you request its erasure, withdraw your consent for its storage, or the purpose for its storage no longer per-tains (e.g. after fulfilling your request). Mandatory statutory provisions - in particular retention periods - remain unaffected.
 

Disclosure of data to third parties
Your data will not be passed on to third parties.
 

Objection and withdrawal
Your consent to the processing of personal data on the basis of the use of our con-tact form can be withdrawn at any time.
 

5.3 Cookie consent
 

Purpose of data processing and data categories
 

We use cookies on our website to enable its use, analyse the website and personal-ise content and advertising. This involves processing session IDs, temporary set-tings, preferences, anonymised usage data and pseudonymised tracking or market-ing information.
This website uses the following types of cookies. Their scope and functionality are explained below:
•    Persistent cookies
•    Session cookies
 

We differentiate between:
•    Session cookies: These cookies are only stored during your visit and are au-tomatically deleted when you close your browser. For example, they enable the management of your session, the security of logins, or the temporary stor-age of settings such as language or shopping cart.
•    Persistent cookies: These cookies remain stored on your device beyond your visit and are only removed after a defined period of time or by manual dele-tion. They are used for personalised content, web analysis and marketing purposes.

Legal basis for data processing
Processing is based on our legitimate interest (Art. 6 (1) (f) GDPR) in the secure, functional and user-friendly operation of the website. Where necessary, in particular for personalised advertising, web analysis or similar technologies, processing will only take place with your consent to the storage of cookies and similar recognition technologies (Art. 6 (1) (a) GDPR). In addition, processing may be carried out to comply with legal obligations (Art. 6 (1) (c) GDPR).
You can disable cookies and similar technologies in your browser; however, this may restrict your use of the website. Cookies do not install any programmes on your device.
Duration of storage

Session cookies
Session cookies are stored exclusively for the duration of your visit to the website and are automatically deleted at the end of the browser session. They serve to en-sure the secure, functional and user-friendly operation of the website, for example for session control or to guarantee basic functions. Processing is carried out on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR. Session cook-ies are not used for analysis or advertising purposes, do not install any programmes and do not contain any malware.

Persistent cookies
Persistent cookies remain on your device for a specified period of time, which is de-fined by the cookie itself, or until you delete them manually. For example, they ena-ble the storage of settings, the recognition of returning users, or analysis and mar-keting functions. Processing is carried out either on the basis of your consent in ac-cordance with Art. 6 (1) (a) GDPR or, if technically necessary, on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR. You may withdraw your consent at any time. Persistent cookies do not install any programmes and do not contain any malware.

Disclosure of data to third parties
Our website uses cookies to analyse the use of our services, to ensure the function-ality of the site and to make online tracking compliant with data protection regula-tions. For this purpose, we use the Cookiebot web service provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark.
We have concluded an order processing contract (AVV) with Cookiebot. This is a contract required by data protection law that ensures that the service provider only processes the personal data of our website visitors in accordance with our instruc-tions and in compliance with the GDPR.
 

Objection and withdrawal
If you have given your consent to the use of persistent cookies, you can withdraw this consent at any time. In this case, no corresponding cookies will be set or cook-ies that have already been set will be deleted.
 

5.4 Google Analytics
Purpose of data processing and data categories
This website uses Google Analytics, a web analytics service provided by Google Inc. ('Google'). Google Analytics uses so-called 'cookies', text files that are stored on your computer and enable an analysis of your use of the website.
The following data is collected:
•    IP address of the accessing device (abbreviated/anonymised)
•    Pages visited
•    Date and time of the server request
•    Time spent on the website
•    Click paths and interactions
•    Origin (referrer URL)
•    Device type, browser type, operating system
•    Screen resolution

Location data (this is determined on the basis of the IP address, but only in a gen-eral form (e.g. city or country); no precise location determination takes place. 
 

Legal basis for data processing
The data is processed on the basis of Article 6 (1) (a) GDPR (consent). The collec-tion and processing of the aforementioned data by Google Analytics only takes place after express consent has been given via our consent management tool. Without this consent, Google Analytics will not collect any data.
 

Duration of storage
The data collected via Google Analytics is stored for a period of 14 months. 
 

Disclosure of data to third parties
The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. Enter address
However, if IP anonymisation is activated on this website, your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. 
The Data Privacy Framework enables the transfer of personal data from the EU to the US in compliance with data protection regulations. With the adequacy decision of the EU Commission, certified companies are subject to an adequate level of data protection in accordance with Art. 45 GDPR. Google is one of the companies that are certified.
 

Objection and withdrawal
Please note that, in accordance with Article 7 GDPR, you may withdraw your con-sent at any time with future effect. The withdrawal only applies to future data pro-cessing. The lawfulness of the processing carried out on the basis of your consent until withdrawal remains unaffected (Art. 7 (3) Sentence 2 GDPR).
Furthermore, pursuant to Article 21 of the GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation, provided that this is based on Article 6 (1) (f) GDPR (legitimate interest).
Since processing in the case of Google Analytics is based on your consent (Art. 6 (1) (a) GDPR), the right of withdrawal takes precedence.
5.4 Social media (Xing, LinkedIn)
 

Purpose of data processing and data categories
We use XING, a service of New Work SE, Am Strandkai 1, 20457 Hamburg, Germa-ny, and LinkedIn, a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, to communicate with you and other interested parties and to in-form you about us, for example about our business activities or job vacancies.
The respective service provider may store cookies on your computer in which the usage behaviour is saved. This user data is anonymised and aggregated by XING/LinkedIn and made available to us for analysis. In addition, we only process the data records that you make available to us via XING/LinkedIn.
 

Legal basis for data processing
The legal basis for the processing of personal data in the context of the provision of the XING or LinkedIn service is Art. 6 (1) (f) GDPR. Our interest lies in informing you about current vacancies. It is also possible that we would like to inform you about current events using this service. 
If you also provide data records via XING/LinkedIn, the legal basis is your consent in accordance with Art. 6 (1) (a) GDPR. If we use information provided by you to estab-lish, implement or process a contractual relationship, the legal basis is Art. 6 (1) (b) GDPR, in the case of employment relationships Art. 6 (1)  b GDPR in conjunction with Section 26 BDSG.
LinkedIn does not share any personal data with us, but only provides anonymised reports on the website audience and ad performance. In addition, LinkedIn offers the option of retargeting via the Insight Tag. We use this data to display targeted ad-vertising outside our website without identifying you as a website visitor. For more information on data protection at LinkedIn, please refer to the LinkedIn privacy policy at de.linkedin.com/legal/privacy-policy?
Processing is carried out on the legal basis of your consent in accordance with Art. 6 (1) (a) GDPR. You may withdraw your consent at any time via our consent manage-ment tool.
 

Duration of storage
We erase your data that you provide to us via XING/LinkedIn when the purpose no longer applies. Since contacting us via XING/LinkedIn can have different purposes, the storage period depends largely on your reason for contacting us.
 

Disclosure of data to third parties
As a rule, we do not pass on data that we have received from you via XING/LinkedIn to third parties. Enter your address.
 

Objection and withdrawal
Data processing based on consent can be withdrawn at any time. The lawfulness of the data processing operations already carried out remains unaffected by the with-drawal. You can also prevent data processing by not clicking on the XING/LinkedIn icon on our website or visiting our channel via XING/LinkedIn.

Last updated: 09/03/2026