Privacy Policy

At Welcoma, protecting personal data and being transparent about how information is processed are important parts of how we design and operate our services.

This Privacy Policy explains how webAufstieg GmbH (“Welcoma”, “we”, “us” or “our”) collects, uses, stores and shares personal data when you visit welcoma.app, create or use a Welcoma account, purchase a Welcoma plan, contact us, request or perform an accessibility scan, or use Welcoma products and services.

It also explains how Welcoma handles information in connection with the accessibility widget installed on customer websites.

This Privacy Policy is intended to provide information required under the EU General Data Protection Regulation (“GDPR”), applicable German data-protection law, the UK GDPR and applicable privacy laws in the United States and other jurisdictions.

1. Who is responsible for your data?

The controller responsible for personal data processed by Welcoma for its own purposes is:

webAufstieg GmbH
Anton-Huber-Straße 20
73430 Aalen
Germany

Contact: info@webaufstieg.de
Phone: +49 7361 6339046

When Welcoma processes personal data solely on behalf of one of its customers, the customer generally acts as the controller and Welcoma acts as a processor or service provider.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through:

• welcoma.app and associated Welcoma websites;
• Welcoma customer accounts and dashboards;
• Welcoma subscriptions, licences and purchases;
• Welcoma accessibility plugins and integrations;
• accessibility scans and scan reports;
• accessibility statement tools;
• customer support and contact communications;
• account and licence administration;
• payment and billing administration;
• translation and plain-language functions;
• AI-assisted functionality;
• email communications; and
• other accessibility-related Welcoma products and services.

A customer who installs Welcoma on their own website remains responsible for the privacy practices of that website and for providing privacy information required for their own visitors.

3. Personal data we collect

Depending on how you interact with Welcoma, we may process different categories of personal data.

3.1 Website and technical information

When you access welcoma.app or use Welcoma services, technical information may automatically be processed.

This may include:

• IP address;
• date and time of access;
• requested URL;
• referrer URL;
• browser type;
• operating system;
• device information;
• user agent;
• server request information;
• error information; and
• other technical log information.

We process this information to make our website and services available, maintain security, troubleshoot technical problems, detect misuse and ensure the stability of our infrastructure.

The legal basis is our legitimate interest in operating a secure and reliable service pursuant to Article 6(1)(f) GDPR.

4. Welcoma account information

When you create or use a Welcoma account, we may process information such as:

• name;
• email address;
• company or organisation name;
• account credentials and authentication information;
• subscription information;
• licence information;
• API keys;
• connected website domains;
• account settings;
• accessibility scan history;
• plan and usage information; and
• account-related technical information.

We process this information to create and administer your account and provide Welcoma services.

The legal basis is Article 6(1)(b) GDPR, where processing is necessary to perform our contract with you or take steps at your request before entering into a contract.

5. Connected websites, API keys and licence validation

When Welcoma is installed or connected to a website, the relevant plugin or integration may communicate with Welcoma’s systems.

Depending on the product or feature, this may include:

• Welcoma API key or licence identifier;
• connected website domain;
• licence status;
• subscription plan;
• software version;
• activation information; and
• technical request information.

We use this information to activate and validate licences, manage website limits associated with a plan, provide relevant functionality, prevent unauthorised use and maintain the security of the service.

The legal basis is Article 6(1)(b) GDPR and, where appropriate, our legitimate interests under Article 6(1)(f) GDPR.

6. Accessibility widget and visitor preferences

Welcoma is designed to minimise the personal information transmitted when a visitor uses the accessibility widget installed on a customer’s website.

Accessibility preferences selected through the Welcoma accessibility menu may be stored locally in the visitor’s browser using browser storage such as localStorage.

These preferences may include settings relating to:

• text display;
• contrast;
• colour adjustments;
• reading assistance;
• navigation assistance;
• animation controls;
• accessibility profiles; and
• other accessibility preferences selected by the visitor.

These locally stored accessibility preferences are intended to remember the visitor’s settings.

Welcoma does not receive these locally stored accessibility preferences merely because a visitor adjusts settings within the accessibility widget.

The Welcoma accessibility widget is not designed as an advertising or behavioural tracking technology.

The operator of the website on which Welcoma is installed remains responsible for that website’s own privacy practices, cookies, analytics, advertising technologies and other processing activities.

7. Accessibility scans

When you use or request a Welcoma accessibility scan, we may process:

• your email address;
• your account information;
• the website URL submitted for scanning;
• URLs of pages included in a scan;
• publicly accessible website content;
• page structure;
• HTML and technical website information;
• accessibility findings;
• scan results;
• accessibility issues;
• scan history;
• date and time of scans; and
• information required to generate reports and recommendations.

Welcoma may automatically access publicly available pages on the submitted website to perform accessibility analysis.

We process this information to provide the accessibility scanning service and associated reports, recommendations and account functionality.

The legal basis is generally Article 6(1)(b) GDPR where the scan is part of a Welcoma service requested by the user.

Where you separately register only to receive information about the launch or availability of a future service, processing may be based on your consent under Article 6(1)(a) GDPR.

You can withdraw consent at any time with effect for the future.

8. Contact and customer support

If you contact Welcoma through our website, email or another support channel, we may process:

• first and last name;
• email address;
• company name;
• website address;
• account information;
• licence information;
• message content;
• attachments;
• support history; and
• technical information required to investigate your request.

Where your communication concerns an existing or potential contract, the legal basis is Article 6(1)(b) GDPR.

For other enquiries, technical support, fraud prevention, service administration and business communications, we may rely on our legitimate interests under Article 6(1)(f) GDPR.

9. Payments and billing

Welcoma uses Stripe to process payments for subscriptions, licences and other paid products and services.

When you make a purchase, Stripe may process information such as:

• name;
• email address;
• billing address;
• payment method;
• payment-card or banking information;
• transaction information; and
• information required to prevent payment fraud.

Payment information such as complete payment-card details is generally processed directly by Stripe rather than stored directly by Welcoma.

Welcoma may receive information including:

• payment status;
• transaction ID;
• Stripe customer ID;
• subscription status;
• amount paid;
• invoice information;
• billing information; and
• limited payment-method information.

Processing necessary to complete a purchase is based on Article 6(1)(b) GDPR.

Where billing or transaction records must be kept to comply with tax, commercial or accounting obligations, processing is based on Article 6(1)(c) GDPR.

Stripe may also process certain information under its own privacy responsibilities.

10. Hosting and server infrastructure

Welcoma uses:

Timme Hosting GmbH & Co. KG
Ovelgönner Weg 43
21335 Lüneburg
Germany

for website hosting, server infrastructure and related hosting services.

Through the provision of these services, Timme Hosting may process technical information such as:

• IP addresses;
• server requests;
• timestamps;
• browser and user-agent information;
• error logs;
• security logs; and
• other information necessary to operate and secure the infrastructure.

Where Timme Hosting processes personal data on our behalf, it acts as a service provider or processor subject to applicable data-protection requirements.

11. Email delivery

Welcoma also uses infrastructure provided by Timme Hosting GmbH & Co. KG for email and SMTP services.

Email-related information may therefore be technically processed through Timme Hosting infrastructure when we send or receive communications.

This may include:

• sender email address;
• recipient email address;
• message metadata;
• delivery information;
• timestamps; and
• email content where technically necessary to transmit the communication.

This processing is necessary to communicate with users, administer Welcoma accounts, deliver transactional communications and provide customer support.

Depending on the communication, the legal basis is Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.

12. Service and transactional emails

We may send emails that are necessary for providing and operating Welcoma.

These can include:

• account confirmation emails;
• password and security emails;
• purchase confirmations;
• invoices;
• subscription information;
• licence information;
• scan-related communications;
• support responses;
• important service notifications; and
• changes affecting your account or service.

Transactional communications are not treated as optional marketing communications where they are necessary to provide or administer the service.

13. Marketing communications

We may send marketing communications where permitted by applicable law.

Where consent is required, such communications will be based on your consent under Article 6(1)(a) GDPR.

You can withdraw your consent at any time.

Marketing emails will normally provide an unsubscribe mechanism or another convenient method to stop receiving marketing communications.

Withdrawal of marketing consent does not affect transactional emails that remain necessary for your Welcoma account or services.

14. Cookies and browser storage

Welcoma follows a data-minimisation approach.

The public Welcoma website is designed to avoid unnecessary advertising and behavioural tracking technologies.

Technically necessary technologies may be used where required for:

• authentication;
• account login;
• security;
• session management;
• fraud prevention;
• accessibility settings; and
• essential service functionality.

The Welcoma accessibility widget may use browser localStorage to remember accessibility preferences selected by a website visitor.

Those preferences remain stored within the visitor’s browser and are not automatically transmitted to Welcoma simply because the visitor changes an accessibility setting.

If Welcoma introduces non-essential analytics, advertising or other technologies requiring consent under applicable law, appropriate consent mechanisms will be implemented where required.

15. AI, plain-language and translation functionality

Welcoma may provide optional functionality using artificial intelligence, including:

• plain-language generation;
• rewriting or simplifying content;
• accessibility-related suggestions;
• translation;
• accessibility recommendations;
• AI-assisted website analysis; and
• other AI-supported functionality.

When a customer actively uses such a feature, information necessary to process the request may be transmitted to third-party artificial intelligence providers.

Welcoma currently uses:

OpenAI
and
Google Gemini

for AI and/or language-processing functionality.

Depending on the feature being used, information transmitted to these providers may include:

• website text;
• page content;
• accessibility findings;
• instructions submitted by the customer;
• text submitted for translation;
• text submitted for simplification;
• URLs where required for the feature; and
• other information necessary to generate the requested result.

Customers should avoid submitting unnecessary personal data, confidential information or sensitive personal information to AI-powered functionality.

Where these providers process personal data on Welcoma’s behalf, appropriate contractual and data-protection arrangements are used where required.

The legal basis for processing depends on the feature being used and may include Article 6(1)(b) GDPR for functionality requested as part of the Welcoma service and Article 6(1)(f) GDPR for legitimate operational purposes.

16. International data transfers

webAufstieg GmbH is established in Germany and aims to process personal data within Germany or the European Economic Area where reasonably possible.

However, some technology providers used by Welcoma, including certain AI, payment or infrastructure providers, may process information outside Germany or the European Economic Area, including in the United States.

This may particularly apply when using services provided by companies such as:

• OpenAI;
• Google / Gemini; and
• Stripe.

Where personal data protected by the GDPR is transferred to a country outside the European Economic Area, we use an appropriate transfer mechanism where required by law.

Depending on the provider and transfer, this may include:

• an adequacy decision;
• participation in an applicable recognised data-transfer framework;
• European Commission Standard Contractual Clauses; or
• another legally permitted transfer mechanism.

For personal data subject to UK data-protection law, appropriate UK international-transfer safeguards are used where required.

You may contact us for further information about safeguards applicable to a particular transfer.

17. Service providers and recipients

We disclose personal data only where reasonably necessary to operate Welcoma, fulfil our contractual obligations, comply with applicable law or protect our legitimate interests.

Current categories of service providers include:

Hosting and email infrastructure
Timme Hosting GmbH & Co. KG

Payment processing
Stripe

Artificial intelligence and language processing
OpenAI
Google Gemini

Other personal data may be disclosed to professional advisers, accountants, legal advisers, governmental authorities or other recipients where required by law or reasonably necessary to establish, exercise or defend legal claims.

Welcoma does not sell personal data.

Welcoma also does not currently share personal data with third parties for cross-context behavioural advertising.

18. Welcoma as controller and processor

Welcoma can have different data-protection roles depending on the circumstances.

Welcoma as controller

webAufstieg GmbH generally acts as controller when processing information for purposes including:

• Welcoma customer accounts;
• subscriptions and billing;
• website operation;
• customer support;
• licence administration;
• sales communications;
• Welcoma’s own security; and
• direct relationships with Welcoma customers.

Welcoma as processor

For certain functions, a Welcoma customer may determine why and how personal data relating to its own website or users is processed.

In such circumstances:

● the Welcoma customer generally acts as controller or business; and
● Welcoma may act as processor or service provider.

Where required, processing on behalf of customers may be governed by a Data Processing Agreement.

If you are a visitor to a customer’s website and your privacy request relates to information controlled by that website operator, you should normally contact that website operator directly.

Welcoma will assist customers where required by applicable data-protection law and our contractual obligations.

19. How long we retain personal data

Welcoma aims to retain personal data only for as long as necessary for the purposes for which it was collected.

Welcoma account data

Account-related information is retained while your Welcoma account remains active.

When you delete your Welcoma account, Welcoma deletes the personal information associated with the account from its active systems, subject to information that must be retained because of legal obligations, security requirements or legal claims.

Accessibility scan data

Accessibility scan registrations, scan history, scan reports and account-associated scan information are retained while your Welcoma account remains active.

When you delete your Welcoma account, this information is deleted together with the account, unless continued retention is legally required.

Server and technical log information

Server and technical log information associated with your Welcoma account is retained while your account remains active and is deleted when the account is deleted, subject to information that must temporarily or legally be retained for security, fraud prevention, incident investigation or other legal requirements.

Support communications

Support and account communications may be retained while your account remains active. When an account is deleted, associated support information may also be deleted unless continued retention is necessary to comply with legal obligations, resolve an ongoing dispute, document a transaction or establish, exercise or defend legal claims.

Payment, invoice and accounting information

Deleting a Welcoma account does not necessarily result in the immediate deletion of information that webAufstieg GmbH is legally required to keep.

Invoices, transaction records and accounting information may therefore be retained for the applicable statutory retention periods under German commercial and tax law.

After the relevant legal retention period expires, this information is deleted in accordance with our data-retention procedures.

Consent-based information

Where personal data is processed based on your consent, you may withdraw consent at any time.

Following withdrawal, the information will no longer be processed for the consent-based purpose unless another legal basis permits or requires continued processing.

20. Deleting your Welcoma account

You may delete your Welcoma account using the account deletion functionality made available within welcoma.app.

When account deletion is completed, Welcoma will delete account-associated information including, where applicable:

• profile information;
• connected websites;
• account settings;
• API and licence associations;
• accessibility scan registrations;
• scan history;
• scan results; and
• account-associated technical information.

Deletion does not apply to information that we are legally required to retain, including certain accounting, invoicing, transaction or legal records.

Deleting your account may permanently remove access to associated Welcoma services and stored data.

21. Your rights under the GDPR and UK GDPR

Where the GDPR or UK GDPR applies, you may have the right to:

• obtain confirmation as to whether we process your personal data;
• request access to your personal data;
• obtain a copy of your personal data;
• request correction of inaccurate information;
• request completion of incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• receive certain personal data in a portable format;
• object to certain processing;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent data-protection authority.

Where processing is based on our legitimate interests, you may have the right to object to processing based on your particular situation.

You have the right to object at any time to processing of your personal data for direct-marketing purposes.

To exercise your privacy rights, contact:
info@welcoma.app

We may request reasonable information to verify your identity before completing certain privacy requests.

22. Complaints and supervisory authorities

You have the right to lodge a complaint with a competent data-protection supervisory authority.

For webAufstieg GmbH, the competent supervisory authority is generally:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg)

You may also have the right to contact another competent European supervisory authority, particularly in the country where you live, work or believe a data-protection infringement occurred.

Individuals in the United Kingdom may contact the:

Information Commissioner’s Office (ICO)

We encourage you to contact Welcoma first where possible so we have an opportunity to investigate and address your concern.

23. Additional information for United States residents

Privacy rights within the United States vary by state.

Where an applicable US state privacy law applies to Welcoma and to you, you may have rights including the ability to:

• confirm whether we process your personal information;
• access personal information;
• obtain a copy of personal information;
• correct inaccurate personal information;
• request deletion;
• obtain certain information in a portable format;
• opt out of certain forms of targeted advertising;
• opt out of certain sales or sharing of personal information; and
• appeal certain decisions regarding privacy requests where applicable.

Welcoma does not currently sell personal information.

Welcoma does not currently share personal information for cross-context behavioural advertising.

We will not unlawfully discriminate against you because you exercised an applicable privacy right.

Privacy requests may be sent to:
info@welcoma.app

24. California privacy information

If and to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), applies to Welcoma, California residents may have additional privacy rights.

Depending on your interaction with Welcoma, categories of personal information we may process include:

Identifiers

For example:

• name;
• email address;
• IP address;
• account identifiers; and
• online identifiers.

Customer and commercial information

For example:

• Welcoma plan;
• subscription information;
• licence information;
• transaction records; and
• purchase history.

Internet or electronic network activity

For example:

• server requests;
• browser information;
• device information;
• interactions with Welcoma services; and
• technical logs.

Professional information

For example:

• company or organisation name;
• business website; and
• information provided in connection with a business account.

Communications

For example:

• customer-support requests;
• emails; and
• other communications with Welcoma.

We use these categories of information for the purposes explained throughout this Privacy Policy.

Welcoma does not currently sell personal information.

Welcoma does not currently share personal information for cross-context behavioural advertising.

Welcoma does not currently use sensitive personal information for purposes that would require a separate right to limit its use under the CCPA.

Where applicable, California residents may exercise rights provided by the CCPA/CPRA by
contacting:
info@welcoma.app

25. Automated processing and AI-generated results

Welcoma may use automated technologies to generate:

• accessibility scan results;
• accessibility issue classifications;
• AI-generated recommendations;
• plain-language text;
• translated content;
• accessibility suggestions; and
• other technical outputs.

These systems are intended to assist website owners and users.

Welcoma does not currently use solely automated processing to make decisions about individuals that produce legal effects or similarly significant effects.

AI-generated and automated accessibility recommendations should be reviewed appropriately before being relied upon for important legal, accessibility or compliance decisions.

26. Data security

Welcoma uses appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• destruction; and
• unauthorised disclosure.

Security measures are selected taking into account the nature of the information, available technology and the risks associated with the relevant processing activity.

However, no electronic system, internet transmission or storage method can guarantee absolute security.

27. Children’s privacy

Welcoma is primarily intended for:

• businesses;
• organisations;
• website operators;
• developers;
• agencies; and
• professional users.

Welcoma services are not directed specifically at children.

We do not knowingly seek to collect personal data from children for the purpose of creating Welcoma business accounts.

If you believe that a child has provided personal data to us inappropriately, please contact us so that we can investigate and take appropriate action.

28. Third-party websites and services

welcoma.app may contain links to websites or services operated independently from Welcoma.

We are not responsible for the privacy practices, security or content of independent third-party websites.

We recommend reviewing the privacy information provided by the relevant third party before submitting personal information.

29. Changes to this Privacy Policy

We may update this Privacy Policy when:

• Welcoma products change;
• new features are introduced;
• service providers change;
• data-processing activities change;
• legal requirements change; or
• we improve our privacy practices.

The latest version will be published on welcoma.app together with its effective or “Last updated” date.

Where required by law, we will provide additional notice before a material change takes effect.

30. Contact us

If you have questions about this Privacy Policy, our processing of personal data or your privacy rights, please contact:

webAufstieg GmbH
Anton-Huber-Straße 20
73430 Aalen
Germany

Email: info@welcoma.app
Phone: +49 7361 6339046