This is a translation for convenience. In case of doubt, the German version is authoritative.
With the Marketplace Configurator you can describe your marketplace project and have a draft generated from it. In doing so we process personal data. This page explains which data that is, why we process it and what rights you have.
We have tried to keep this policy as understandable as possible. If anything remains unclear, just get in touch with us.
The controller responsible for data processing on this website is:
wunschlösung GmbH
Wagnergasse 8
07743 Jena
Germany
Phone: +49 3641 55 980 660
E-Mail: hello@wunschloesung.com
We process personal data only where this is necessary and a legal basis exists. The possible legal bases are:
You can withdraw a consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.
This website is hosted by:
Keyweb AG
Neuwerkstraße 45/46
99084 Erfurt
Germany
All parts of this website run on this server, including the database and the login.
Each time this website is accessed, the server automatically collects information that your browser transmits. This is:
This data is technically necessary to deliver the website, to ensure its stability and security and to fend off attacks. It is not merged with other data and does not serve to identify you.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website.
Retention period: at most 14 days
We use cookies and similar technologies. Cookies are small text files that are stored on your device.
Technically necessary cookies are set without your consent. These include cookies that store your consent decision, keep your session in the configurator alive and, if you create an account, secure your login. Without them the website does not work.
We also store your progress in the configurator, including your description and your answers, in your browser's local storage so that nothing is lost when you reload the page. It stays there until you start a new marketplace or clear the website data in your browser.
Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
All other cookies are set only if you have consented. When you first visit the website we show you a notice for this, in which you can decide per category. For management we use our own solution, which does not pass any data to third parties.
We store your decision so that we do not have to ask again on your next visit. You can change it at any time, or withdraw it entirely, via the link in the footer of every page.
We use Google Consent Mode v2. It ensures that the Google and advertising services named below receive your decision and behave accordingly.
Retention period of the consent: We store your decision in your browser's local storage until you change it or clear the website data in your browser. If we ask about new categories, we ask you for your decision again.
We use Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The Tag Manager itself is not an analytics or advertising tool. It is a management tool with which we integrate and control the services named in this policy. It sets no cookies of its own for analytics or advertising purposes.
When the Tag Manager is loaded, however, your IP address is transmitted to Google. The services delivered through the Tag Manager are loaded only after you have consented to the respective category.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG, your consent.
We use Google Analytics 4, a service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics helps us understand how the configurator is used: which steps work, where people drop off and how long they take. We use this to improve the service.
Data processed: IP address, pages visited, time and duration of the visit, origin of the visit, device and browser used, interactions in the flow, pseudonymous identifier.
Google uses your IP address only briefly to derive your approximate location from it and does not store it for visitors from the EU. We cannot directly attribute the data to you personally.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG, your consent.
Retention period: 14 months
Recipient and third country: Google Ireland Limited. A transfer to Google LLC in the USA takes place, see section 11.
Further information: https://policies.google.com/privacy
We advertise this service on Meta, Google and LinkedIn. To understand which ads actually lead to usage, and to reach out again to people who have shown interest in the service, we use the following services.
All services in this section are loaded exclusively after your consent.
In certain cases we transmit hashed contact data. If you create an account, your email address may be transmitted to the advertising platforms in a non-reversible format (hash value) so that they can attribute a completion to the right ad. The hash value is not plain text, but it remains personal data because the platforms can match it against data they already hold. That is why we point this out explicitly.
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
We use the Meta Pixel. It records which pages you visit and whether you complete the configurator. In addition we use the Conversions API. With it we transmit the same events to Meta from our server as well, including hashed contact data.
We also use Custom Audiences. Meta builds audiences from visitors to this website to whom we can later show ads again.
Data processed: IP address, browser and device information, pages visited, events triggered, Meta cookie identifiers, hashed email address where applicable.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG, your consent.
Meta's privacy policy: https://www.facebook.com/privacy/policy
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We measure which of our Google ads lead to usage. In addition we use Enhanced Conversions. With it we transmit hashed contact data so that Google can attribute completions more reliably. Through Google Remarketing we build audiences for renewed outreach.
Data processed: IP address, browser and device information, pages visited, events triggered, Google cookie identifiers, hashed email address where applicable.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG, your consent.
Google's privacy policy: https://policies.google.com/privacy
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
The Insight Tag records whether a visit originates from a LinkedIn ad and enables the building of audiences for renewed outreach. LinkedIn provides us only with aggregated, non-personal reports.
Data processed: IP address, browser and device information, pages visited, LinkedIn identifiers, hashed email address where applicable.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG, your consent.
LinkedIn's privacy policy: https://de.linkedin.com/legal/privacy-policy
For the collection and transmission of data to Meta and to LinkedIn we are jointly responsible with the respective provider within the meaning of Art. 26 GDPR. The respective provider alone is responsible for the subsequent further processing in its own systems.
We have concluded the agreements provided for this purpose with both providers. Their essential content is available here:
You can assert your rights both against us and against the respective provider. For information about processing in the providers' systems, please contact them directly, as only they hold the complete information.
In the configurator you describe your project in a free-text field, answer follow-up questions and confirm or change a series of suggestions.
Data processed: your description of the project, your answers to the follow-up questions, your choices in the rest of the flow, the chosen name and the chosen design.
We process this information to generate your marketplace draft and your profile from it. That is the purpose for which you use the service.
Please note: What you write in the free-text field is up to you. For a good result we need no names, no contact details and no information about individual persons. Please do not provide such information if it is not necessary to describe your project.
Legal basis: Art. 6(1)(b) GDPR, the use of the service you requested.
To understand your description and sensibly pre-fill the following steps, we use an AI language model. Your description and your answers are transmitted to the following provider and processed there:
OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. The data is processed outside the EU, mainly in the USA. We have concluded a data processing agreement with OpenAI under Art. 28 GDPR. The transfer to third countries is based on standard contractual clauses under Art. 46(2)(c) GDPR.
The provider processes your entries exclusively on our behalf and according to our instructions.
Your entries are not used to train AI models.
Retention period at the provider: up to 30 days. OpenAI keeps inputs and outputs for that long, among other things to detect abuse; after that they are deleted.
Legal basis: Art. 6(1)(b) GDPR, the provision of the service you requested.
Before a marketplace goes online, we automatically check its content – texts and uploaded images such as your logo – with the same AI model for violations of our content rules. If something stands out, a member of our team looks at the marketplace before it is published.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is not to publish unlawful content on our platform.
So that you can pick up where you left off and we can generate your draft from it, we store your details on our server during the flow, as soon as we have analysed your description. As long as you have not created an account, this happens without your name and without your email address.
Retention period: We keep your details so that your project can be implemented, even if you do not complete the flow, and delete them six months after your last change.
Legal basis: Art. 6(1)(b) GDPR.
If you want to keep or share your draft, you create an account.
Data processed: name and email address, password in encrypted form, time of registration, the information you provided in the configurator and the generated draft. In the last step, if you provide them, your phone number and your answers about your biggest hurdle, the planned launch, your team and your budget are added.
We store the password exclusively as a non-reversible hash value. Nobody at our company can view your password.
If you share your draft, it is accessible via the link you pass on to everyone who knows the link. So think about whom you share it with.
When you complete the configurator with your account, our team receives an internal notification with your contact details and your information. We only get in touch with you if you ticked the box for it (see section 10). Legal basis for the notification: Art. 6(1)(f) GDPR. Our legitimate interest lies in seeing which projects are created with the configurator.
Retention period:
Legal basis: Art. 6(1)(b) GDPR.
Before we analyse your description, we use Google reCAPTCHA to check whether a person or a program is using the configurator. The analysis costs computing power, which we protect from automated requests this way. The same applies to our contact form.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA is loaded as soon as you open the step with your description or the contact form.
Data processed: IP address, browser and device information, date and time, interactions with the page such as mouse movements and clicks, and Google cookies. To confirm the check, our server sends its result together with your IP address to Google.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the configurator and the contact form from automated requests and abuse. Access to your device is based on Section 25(2) no. 2 TDDDG.
Recipient and third country: Google Ireland Limited. A transfer to Google LLC in the USA takes place, see section 11.
Further information: https://policies.google.com/privacy
If you write to us, call us or arrange an appointment, we process your details in order to handle your request.
Data processed: name, contact details, content of your request, time.
Legal basis: Art. 6(1)(b) GDPR for contractual or pre-contractual requests, otherwise Art. 6(1)(f) GDPR with our legitimate interest in responding.
For appointment booking we use: Calendly, a service of Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA.
We only load the calendar when you click “Book a call”. Calendly then receives your IP address and information about your browser and, if you book an appointment, also the details you enter there, such as your name, your email address and your request.
Legal basis: Art. 6(1)(b) GDPR, arranging the appointment you asked for. Loading the calendar when you click is based on Section 25(2) no. 2 TDDDG.
Recipient and third country: Calendly LLC, USA, see section 11. Calendly's privacy policy: https://calendly.com/legal/privacy-notice
We do not use this data for advertising purposes on Meta, Google or LinkedIn.
Retention period: until your request has been fully handled, thereafter in accordance with statutory retention periods.
If you ticked the box at the end of the configurator asking us to get in touch, we will contact you once, by email or, if you provided a phone number, by phone, to talk about your draft.
This consent is voluntary. It is not a prerequisite for using the configurator or for creating an account. You can withdraw it at any time, for example by an informal message to hello@wunschloesung.com.
Legal basis: Art. 6(1)(a) GDPR.
Some of the services named transmit data to the USA or to other countries outside the European Union. There, no level of data protection comparable to the GDPR applies. In particular, government bodies may under certain conditions access data without effective legal remedies being available to you.
Affected are:
| Service | Recipient in the third country | Basis of the transfer |
|---|---|---|
| Google Analytics, Google Ads, Google Tag Manager, Google reCAPTCHA | Google LLC, USA | EU-US Data Privacy Framework, supplemented by standard contractual clauses |
| Meta Pixel, Conversions API, Custom Audiences | Meta Platforms, Inc., USA | EU-US Data Privacy Framework, supplemented by standard contractual clauses |
| LinkedIn Insight Tag, Matched Audiences | LinkedIn Corporation, USA | EU-US Data Privacy Framework, supplemented by standard contractual clauses |
| AI evaluation of your description | OpenAI group companies, mainly USA | Standard contractual clauses |
| Calendly (appointment booking) | Calendly LLC, USA | EU-US Data Privacy Framework |
Where we rely on your consent for these transfers, it is given under Art. 49(1)(a) GDPR in awareness of the risks described.
| Data | Duration |
|---|---|
| Server log files | at most 14 days |
| Consent decision | until you change it or clear the website data in your browser |
| Configurator progress in your browser | until you start a new marketplace or clear the website data in your browser |
| Details in the configurator, also without an account | six months from your last change |
| Draft | four weeks from assignment to your account, longer on request |
| Account data | until the account is deleted at your request |
| Analytics and advertising data | Google Analytics 14 months, otherwise according to the periods of the respective provider |
| Entries at the AI provider | up to 30 days |
| Requests and correspondence | until handled, then according to statutory periods |
| Backups | one month |
Deleted data can remain in our nightly backups for up to one month until they are overwritten.
You have the right:
To exercise these rights, an informal message to hello@wunschloesung.com is sufficient.
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit
Häßlerstraße 8
99096 Erfurt
You can also contact the supervisory authority of your place of residence or of your workplace.
We adapt this policy when our services or the legal situation change. The version available here applies in each case.
Version: 1 October 2026