Privacy policy
Winners & Co. GmbH
Last updated: August 2026
1. Controller
The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Winners & Co. GmbH
Schäfflerstraße 3
80333 Munich
Germany
Email: sw@winners.digital
Managing Director: Stefan Winners
2. General Information on Data Processing
We process personal data only to the extent necessary to provide and operate this website, to communicate with visitors and business contacts, to analyse the use of our website where consent has been given, and to protect our legitimate business interests.
Personal data means any information relating to an identified or identifiable natural person.
The processing of personal data is carried out in accordance with the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) and, where applicable, the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz - TDDDG).
3. Website Hosting and Squarespace
This website is hosted and operated using services provided by Squarespace. In connection with the provision, security and operation of the website, Squarespace may process technical and usage data on our behalf, including IP addresses, device and browser information, log data and information required to deliver website content.
Where Squarespace processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.
The legal basis for processing necessary to provide and secure the website is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient operation of our website.
Squarespace may process data in countries outside the European Economic Area. Where this occurs, transfers are made subject to the requirements of Chapter V GDPR, including applicable adequacy decisions and/or appropriate safeguards such as Standard Contractual Clauses.
4. Server Log Files
When you access our website, certain technical information is automatically transmitted by your browser to the servers used to provide the website. This information may include:
· IP address
· date and time of access
· requested page or file
· referring website
· browser type and version
· operating system and device information
· access status or HTTP status code
This data is processed to ensure the secure, stable and technically reliable operation of the website and to detect and prevent misuse and security incidents.
The legal basis is Art. 6(1)(f) GDPR. Log data is retained only for as long as necessary for these purposes, unless a longer retention period is required by law or necessary to investigate a security incident.
5. Cookies and Consent Management
Our website uses cookies and similar technologies. Some cookies are technically necessary for the operation and security of the website. Other cookies and technologies, in particular those used for analytics, are activated only after you have given your consent through our cookie consent banner.
Where the storage of information on your device or access to information already stored on your device requires consent, the legal basis is Section 25(1) TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR.
Technically necessary cookies and similar technologies may be used without consent where the requirements of Section 25(2) TDDDG are met. Related processing of personal data is based, where applicable, on Art. 6(1)(f) GDPR.
You can withdraw or change your consent at any time with effect for the future through the cookie/privacy settings available on our website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Google Analytics
Subject to your consent, this website uses Google Analytics, a web analytics service provided by Google. Google Analytics helps us understand how visitors use our website and enables us to improve its content and performance.
Google Analytics may process information such as page views, interactions, approximate location, browser and device information, referral information and identifiers associated with analytics cookies or similar technologies. According to Google, individual IP addresses of users in the EU, Switzerland and the United Kingdom are not logged or stored by Google Analytics; IP addresses are used for geolocation and are discarded before the relevant analytics data is logged.
Google Analytics is activated only after you have given your consent through our cookie consent banner. The legal basis for storing or accessing information on your device is Section 25(1) TDDDG; the legal basis for the subsequent processing of personal data is Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future through the cookie/privacy settings on our website.
Google may process data outside the European Economic Area, including in the United States. Where personal data is transferred internationally, the transfer is subject to the requirements of Chapter V GDPR. Depending on the circumstances, this may include an applicable adequacy decision, including the EU-U.S. Data Privacy Framework for certified recipients, and/or appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. Contacting Us
If you contact us by email, telephone or another communication channel, we process the personal data you provide in order to respond to your inquiry and communicate with you.
Depending on the nature of your inquiry, the legal basis is Art. 6(1)(b) GDPR where the communication relates to a contract or pre-contractual measures, or Art. 6(1)(f) GDPR based on our legitimate interest in responding to business and other inquiries.
Correspondence is retained only for as long as necessary for the relevant purpose and in accordance with applicable statutory retention obligations.
8. External Links
Our website may contain links to websites or services operated by third parties, including social media platforms. When you follow such a link, you leave our website. The processing of personal data on third-party websites is governed by the privacy policies and practices of the respective providers. We are not responsible for the data processing practices of independent third-party websites.
9. Recipients and Processors
We may use external service providers to operate and maintain our website and IT infrastructure, including Squarespace and, where you have consented to analytics, Google.
Where service providers process personal data on our behalf, they are contractually bound in accordance with Art. 28 GDPR where required. Personal data is otherwise disclosed only where necessary for the relevant purpose, required by law, necessary for the establishment, exercise or defence of legal claims, or where you have given your consent.
10. International Data Transfers
Where personal data is transferred to recipients outside the European Economic Area (EEA), we ensure that the requirements of Chapter V GDPR are met. Depending on the recipient and destination country, transfers may be based on an adequacy decision by the European Commission, including the EU-U.S. Data Privacy Framework where applicable, or on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
11. Retention of Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected. Where statutory retention obligations apply, data may be retained for the duration of the applicable statutory retention period. After the relevant purpose ceases to apply and any statutory retention periods have expired, the data will be deleted or anonymised unless further processing is permitted or required by law.
12. Your Rights
Subject to the applicable legal requirements, you have the right to:
· obtain information about the personal data we process about you (Art. 15 GDPR);
· request rectification of inaccurate personal data (Art. 16 GDPR);
· request erasure of your personal data (Art. 17 GDPR);
· request restriction of processing (Art. 18 GDPR);
· receive personal data you have provided to us in a structured, commonly used and
machine-readable format and, where applicable, request its transmission to another
controller (Art. 20 GDPR);
· object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR); and
· withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
Where you object to processing based on our legitimate interests, we will cease processing the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
13. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority pursuant to Art. 77 GDPR.
For a company based in Munich, the competent supervisory authority is generally:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
You may also contact another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.
14. Data Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our website uses encrypted transmission via SSL/TLS where supported by your browser.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our website, the services we use or applicable legal requirements. The current version is available on this website.
Last updated: August 2026