Data Protection

1. Controller

The controller within the meaning of the GDPR is:
X2E GmbH
Große Ahlmühle 19
76865 Rohrbach
Deutschland
E-Mail: info@x2e.de
Website: www.x2e.de

2. Contact for Data Protection Enquiries

For questions regarding data protection and to exercise your rights as a data subject, you can reach us at any time at: datenschutz@x2e.de

Our Data Protection Officer is Matthias Tielmann, reachable via NOTOS Xperts GmbH, Heidelberger Straße 6, 64283 Darmstadt, Germany.

3. General Website Processes

When you access our website, our system automatically collects data and information from the accessing device. This includes, among other things, the browser type, the operating system, the IP address, date and time of access, the pages accessed, the previously visited website (referrer) and similar technical information. This data is processed for the delivery of the website, for system security and stability as well as for threat prevention – for example in the event of a cyber attack. No personalised evaluation takes place; the data is analysed in anonymised form for statistical purposes. The legal basis for the processing is our legitimate interest pursuant to Article 6(1)(f) GDPR in achieving the purposes mentioned above.

The data is deleted no later than seven days after collection; any longer storage takes place exclusively in anonymised form. As the collection of this data is strictly necessary for the operation of the website, there is no right to object.

To accelerate and reliably deliver our website, we use technically necessary caching mechanisms. No personalised evaluation takes place; the processing is based on our legitimate interest in the secure and performant operation of our website (Article 6(1)(f) GDPR).

4. Contacting Us

4.1. General Enquiries

On our website you have the possibility to contact us – for example via a contact form provided, by e-mail or by phone. We process the data transmitted in this context solely for the purpose of handling your enquiry. The legal basis is our legitimate interest in responding to enquiries pursuant to Article 6(1)(f) GDPR as well as the implementation of pre-contractual measures pursuant to Article 6(1)(b) GDPR. The data will be deleted as soon as it is no longer required for the purpose of the communication, unless statutory retention obligations prevent deletion.

Contact in the Context of Existing Relationships

Within ongoing customer relationships, we regularly contact our customers, for example to coordinate content, to clarify open questions, to address changes to contractual terms or to transmit relevant information. The processing of personal data takes place to perform the contractual relationship, if the person addressed is a contracting party themselves, or otherwise on the basis of our legitimate interest in efficient communication (Article 6(1)(f) GDPR). We delete data of customers and contact persons as soon as the data is no longer required for the aforementioned purposes. This is usually the case no later than 3 years after the end of our cooperation.

4.3. Job Applications

Our website provides a careers page listing our current job openings. Applications are subsequently submitted by e-mail to the address stated in the respective job posting. We process the personal data you submit for the purpose of carrying out the application procedure. This includes in particular your contact details, CV, certificates and any other information you provide in the context of your application.

The legal basis for processing your application data is the initiation of an employment relationship pursuant to Section 26 BDSG (German Federal Data Protection Act) and – where necessary – our legitimate interest in defending against legal claims within the scope of the AGG (General Equal Treatment Act) pursuant to Article 6(1)(f) GDPR.

If, in the context of your application, you provide us with special categories of personal data within the meaning of Article 9(1) GDPR (e.g. health data such as information regarding severe disability status), processing takes place on the basis of Section 26(3) BDSG in conjunction with Article 9(2)(b) GDPR in order to exercise rights and fulfil obligations arising from employment law as well as social security and social protection law.

In certain cases, the processing of special categories of personal data may also be based on Article 9(2)(h) GDPR, for example if your information is needed to assess your fitness for work, or in the context of occupational medical examinations, pre-employment examinations or the implementation of health-related measures.

If no employment relationship results, your data will be deleted no later than six months after completion of the application procedure, unless you have expressly consented to longer storage. If you are hired, your data will be transferred to your personnel file.

5. Cookies and Consent Management

Our website uses so-called cookies. These are small text files that the browser used can store on, and read from, the end device of users. Cookies can either be stored only for the duration of a session and then automatically deleted (session cookies) or remain on the end device permanently (persistent cookies).
Technically necessary cookies are strictly required for the operation and provision of our website and for the optimised use of our services. Access to data already stored on your end device and the storage of these cookies are therefore based on the necessity for a service requested by you (Section 25(2) No. 2 TDDDG, German Telecommunications Digital Services Data Protection Act) as well as on our legitimate interest (Article 6(1)(f) GDPR) in the functional, legally compliant, secure and user-friendly provision of our website.

For all cookies and processing operations that are not strictly necessary – in particular for the services described in the section „Web Analytics“ – we obtain your consent via a consent management tool („Complianz“, Complianz B.V., Atoomweg 6b, 9743 AK Groningen, Netherlands). Your selection is documented in a cookie in your browser and can be adjusted or withdrawn at any time via the cookie settings on our website. The legal basis for the use of the consent management tool is Article 6(1)(c) GDPR in conjunction with Section 25 TDDDG (compliance with a legal obligation to document consent).

You may withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing based on consent before its withdrawal.

6. Web Analytics and Tag Management

On our website, we use – subject to your explicit consent given via the cookie banner – analytics and management services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“). The legal basis for the data processing is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie settings on our website.

6.1. Google Analytics (with IP Anonymistation)

We use Google Analytics to statistically evaluate the behaviour of website visitors in order to continuously improve our website. IP anonymisation („anonymizeIp“) is used, so that your IP address is truncated and thereby anonymised prior to any evaluation. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Transfers to the USA may take place. For Google, an adequacy decision by the European Commission (EU-US Data Privacy Framework) is in place; in addition, we have concluded standard contractual clauses pursuant to Article 46 GDPR.

Data collected via Google Analytics is deleted no later than 14 months. Further information can be found in Google’s privacy information at https://policies.google.com/privacy.

6.2. Google Tag Manager

To manage the tags used on our website, we use Google Tag Manager. Google Tag Manager itself does not set any cookies and does not collect any personal data for analytical purposes. It serves solely to integrate and control other tags, which in turn may collect data. If deactivation is carried out at the domain or cookie level, this will remain in place for all tracking tags implemented via Google Tag Manager.

7. Embedded Fonts (Google Fonts)

For the consistent display of fonts, we use web fonts provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“). When you access our website, your browser loads the required fonts from Google servers in order to display text and fonts correctly. For technical reasons, your IP address is transmitted to Google in this process. The use of Google Fonts serves our interest in a uniform and appealing presentation of our website.

The legal basis is our legitimate interest in a uniform presentation of our website pursuant to Article 6(1)(f) GDPR. Transfers to the USA may take place. An adequacy decision by the European Commission (EU-US Data Privacy Framework) is in place; in addition, we have concluded standard contractual clauses with Google pursuant to Article 46 GDPR.

8. Multilangual Display of the Website

In order to provide our website in multiple languages, we use the WordPress plugin WPML. WPML stores your language selection in a technically necessary cookie, so that the website can be delivered to you in the selected language on your next visit. No personalised evaluation takes place. The legal basis is Section 25(2) No. 2 TDDDG in conjunction with our legitimate interest in the user-friendly provision of the website (Article 6(1)(f) GDPR).

9. Empfänger und Weitergabe personenbezogener Daten

In order to fulfil our contractual and statutory obligations and to provide our services, it may be necessary to disclose personal data to third parties. This concerns in particular authorities, public bodies, parties involved in proceedings (e.g. opponents, data subjects, other participants), tax authorities, banks and insurers.

To support our business operations, we also use external service providers to whom personal data may be transmitted in the course of their activities. Insofar as these service providers process personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR. Processing takes place exclusively within the EU or the EEA, or subject to suitable safeguards within the meaning of Articles 44 et seq. GDPR.

10. Storage Period of Yout Data

Personal data is deleted as soon as the respective purpose of its processing ceases to apply, unless statutory retention obligations – in particular under commercial and tax law – prevent deletion.


Where specific retention periods are stated in this Privacy Notice, these shall take precedence.

11. Your Rights as a Data Subject

You are entiteled to the following rights:

• Right of Access: You can request information from us as to whether and which personal data we process about you (Article 15 GDPR).
• Right to Rectification: If data we process about you is inaccurate, you can inform us of this and have the right to have us correct this data (Article 16 GDPR).
• Right to Erasure / Right to Be Forgotten: If personal data is no longer necessary for our processing purposes or if the legal basis ceases to apply for another reason, you have the right to have your personal data erased (Article 17 GDPR).
• Right to Restriction of Processing: Under certain conditions, you can require us to restrict the processing of your data (Article 18 GDPR).
• Right to Data Portability: You can request a copy of your data in a commonly used, machine-readable format, or ask us to transmit the data directly to a provider of your choice (Article 20 GDPR).
• Right to Object: You can object to the processing if it is based on our legitimate interests (Article 21 GDPR).
• Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing (Article 22 GDPR).
• Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us, if you disagree with the way your data is handled (Article 77 GDPR).
• Right to Withdraw Consent: You have the right to withdraw any consent given at any time with effect for the future. This does not affect the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal (Article 7(3) GDPR).

To exercise your rights vis-a-vis us, you can contact us at any time using the contact details for data protection enquiries listed above.

As of: April 2026