Privacy statement

Last updated: October 2026

This privacy statement explains which personal data we process when you visit this website, for what purpose and on what legal basis. This English version is provided for convenience; in case of doubt, the German version prevails. You can change your choice regarding cookies and statistics at any time via the cookie settings.

1. Controller

oneCorp GmbH, represented by its managing director Tristan Fischer
Güterbahnhofstraße 11, 69151 Neckargemünd, Germany
Phone: +49 6223 8009380, email: info@onecorp.eu

2. Data protection officer

DataCo GmbH, Sandstr. 33, 80335 Munich, Germany
Phone: +49 89 7400 45840, email: privacy@dataguard.com, www.dataguard.de

3. Overview

We only process personal data to the extent necessary to operate this website, to handle your enquiries or with your consent. The legal bases are Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interest). Storing information on your device and accessing it is additionally governed by Section 25 of the German TDDDG: without consent only where strictly necessary for the service you have requested.

We delete data as soon as the purpose no longer applies and no statutory retention obligation prevents deletion. Some service providers are based in the USA. We base transfers there on the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF) where the recipient is certified, otherwise on standard contractual clauses. We have concluded data processing agreements under Art. 28 GDPR with service providers that process data on our behalf.

4. Visiting the website and hosting

This website is hosted by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Webflow delivers the pages via content delivery networks and uses the following sub-processors for this: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA (Amazon CloudFront). Each visit involves processing technically required data: IP address, date and time, page requested, amount of data transferred, referrer URL, browser and operating system.

The purpose is to deliver the website, keep it stable and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Cloudflare sets the cookie “_cfuvid”, which distinguishes individual visitors to protect against overload and is deleted at the end of the browser session (Section 25(2) no. 2 TDDDG).

Webflow is certified under the DPF; standard contractual clauses apply in addition. Webflow has concluded its own data processing agreements with Cloudflare and Amazon Web Services that include appropriate safeguards for transfers to the USA. Under our data processing agreement, Webflow stores the server logs for no longer than the term of our contract with Webflow; they are deleted after the contract ends. We deliver fonts and scripts ourselves or via Webflow; there is no connection to Google Fonts.

5. Consent management

For services that require consent, we use our own consent management. On your first visit it asks whether you agree to statistics services. “Reject” and “Accept” are equally available on the first level. You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page or here.

We store your choice in the cookie “oc_consent” on your device: date, your choice, the version of the notice text and – only if you consent – a random consent ID. Storage period: up to 12 months (shorter in some browsers, e.g. Safari), after which we ask again. If your browser sends the “Global Privacy Control” signal, we treat it as a rejection.

As proof (Art. 7(1) GDPR) we log consents and their withdrawal with consent ID, time, choice, text and software version and language. Pure rejections are only counted, without an ID. We do not store an IP address, browser details or the page visited. The log runs on our own server service at Cloudflare (address see section 4, DPF-certified); the data is stored in the EU. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; the cookie itself is strictly necessary under Section 25(2) no. 2 TDDDG. We delete log entries 4 years after the respective choice (up to 12 months validity of the choice plus 3 years for proof).

6. Google Analytics 4 (only with consent)

With your consent we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without consent, Google Analytics is not loaded and no data is sent to Google. With consent, Google records which pages you visit, for how long and how you arrived, as well as device, browser, screen size, language and approximate location. According to Google, Google Analytics 4 does not store IP addresses; the location is derived from the IP address, which is then discarded.

The purpose is to understand how our website is used in order to improve content and usability. Google signals and advertising features are disabled; event data is deleted in Google Analytics after 2 months. Google sets the cookies “_ga” and “_ga_6QEL44QNEJ” with a storage period of up to 2 years.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google processes the data as our processor; a transfer to Google LLC in the USA is possible and covered by Google's DPF certification. You can withdraw your consent at any time via the cookie settings; we then delete the Google Analytics cookies and no longer load the service. The lawfulness of processing up to the withdrawal remains unaffected.

7. Contact forms and enquiries

When you submit a form, we process your details: name, company, email address, phone number, your message and, depending on the form, further details about your requirements (e.g. area of interest, rack size, number of workstations, preferred date). In addition, the time and page of the enquiry. Mandatory fields are marked; without them we cannot handle the enquiry. There is no legal or contractual obligation to provide the data.

This is how an enquiry is handled:

• Webflow receives the form, stores the submission and notifies us by email.
• Our server service at Cloudflare (see section 5) receives the submission from Webflow, keeps it for at most 14 days until it has been forwarded successfully (after that only the submission identifier for 30 days to avoid duplicates) and transfers it to our customer management system Pipedrive (Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia).
• At the same time our sales team receives a notification with the enquiry details in Microsoft Teams (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Our email mailboxes are also operated by Microsoft (Microsoft 365). A transfer to, or access from, Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, is possible; Microsoft Corporation is certified under the DPF, and standard contractual clauses apply in addition.

On submission we additionally transmit an empty check field and the seconds since the page was loaded to Webflow and our form server. Both serve only to defend against automated spam submissions; nothing is stored on your device for this. The legal basis is Art. 6(1)(f) GDPR.

The legal basis is Art. 6(1)(b) GDPR if your enquiry aims at a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry and protecting against misuse. We delete submissions in Webflow after 90 days. In Pipedrive, in Microsoft Teams and in our email mailboxes (Microsoft 365) we keep enquiries that do not lead to a contract for up to 2 years after the last contact; if a contract is concluded, the statutory retention periods under German commercial and tax law apply.

8. Contact by email or phone

If you contact us by email or phone, we process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR. Emails are stored in Microsoft 365 (see section 7). We delete the data once your request has been dealt with and no retention obligation applies.

9. Job applications

We provide job advertisements and the application form via Personio (Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany). If you follow the link to Personio, Personio's privacy notices also apply there; Personio processes your application on our behalf. You can also send us your application by email.

We process your application data to carry out the application process on the basis of Art. 6(1)(b) GDPR. If no employment relationship results, we delete the documents 6 months after the process has ended so that we can defend ourselves against possible claims under the German General Equal Treatment Act (AGG).

10. Company pages on social networks

We link to our pages on LinkedIn, Facebook and XING. These are simple links; data is only sent to the respective network when you click the link. On our company pages themselves, the networks process your data under their own responsibility: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and New Work SE (XING), Am Strandkai 1, 20457 Hamburg, Germany.

For page statistics (“Insights”) we are joint controllers with LinkedIn and Meta under Art. 26 GDPR; the networks provide the essential content of the agreements. The legal basis for our processing is Art. 6(1)(f) GDPR; our legitimate interest is communicating with customers and prospects. You can exercise your rights with us or directly with the respective network.

11. External content

In the imprint we show the seal of our professional liability insurance, which is loaded from the servers of exali AG. exali receives your IP address and browser details, as delivery is not otherwise possible. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is evidencing our insurance cover. All other scripts and fonts are delivered by us or via our host.

We only link to Google Maps. No map is embedded; data is only sent to Google when you open the link.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20) as well as the right to object under Art. 21 GDPR (see section 13). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Please contact info@onecorp.eu or our data protection officer.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

13. Right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to info@onecorp.eu.

14. Further information

There is no automated decision-making, including profiling, under Art. 22 GDPR. The website is encrypted throughout using TLS. We update this privacy statement when our services or the legal situation change; the version published here applies.

15. Overview of cookies

• oc_consent – stores your choice in the consent management; provider: oneCorp; storage period: up to 12 months; legal basis: Section 25(2) no. 2 TDDDG.
• _cfuvid – distinguishes visitors to protect against overload; provider: Cloudflare (for Webflow); storage period: session; legal basis: Section 25(2) no. 2 TDDDG.
• _ga – distinguishes visitors for statistics; provider: Google; storage period: up to 2 years; only with consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
• _ga_6QEL44QNEJ – stores the session status for statistics; provider: Google; storage period: up to 2 years; only with consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).