Privacy Policy

This Privacy Notice explains how we process personal data when you visit our website and use our services. This includes, in particular, contact enquiries, seminar registrations and job applications. Data required for technical purposes may be processed as soon as you access the website. We ask for your consent before using analytics functions that require it.

When handling your personal data, such as your name, address, email address or telephone number, we always comply with the applicable data protection laws. This Privacy Notice explains which data we process and the rights you have as a data subject.

We have implemented various technical and organisational measures to protect your data on our websites as effectively as possible. Nevertheless, using the internet always involves risks, and complete protection cannot be guaranteed. You may therefore provide us with your personal data by other means, such as by telephone, if you prefer.

This Privacy Notice provides information on the processing of personal data under the General Data Protection Regulation (GDPR) and the relevant national data protection provisions. Where other data protection laws apply to specific processing activities, their requirements are also taken into account. The legal provisions applicable to each particular case govern the processing.

For ease of reading, our websites, publications, communications and this Privacy Notice do not use separate gender-specific forms for male, female, non-binary and other gender identities. All wording applies equally to all genders.

Please direct any questions about the processing of your personal data or the exercise of your data protection rights to the controller or the designated data protection contact.

Definitions

This Privacy Notice uses specific terms from various data protection laws. To make the notice easier to understand, we explain these terms below.

The definitions in the General Data Protection Regulation are particularly relevant to the following terms.

We use the following terms, among others, in this Privacy Notice:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person, who may also be referred to below as a ‘data subject’. An identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity. This also includes persons who must be regarded as identifiable under national data protection laws or the case law of a country or state, including judge-made law and common law.

b) Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller, a processor, an international organisation or another data recipient. This also includes persons who must be regarded as data subjects under national data protection laws or the case law of a country or state, including judge-made law and common law.

c) Processing

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing means marking stored personal data with the aim of limiting its processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data involving the use of that data to evaluate certain personal aspects relating to a natural person. In particular, this includes analysing or predicting aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation

Pseudonymisation means processing personal data in such a way that it can no longer be attributed to a specific data subject without using additional information, provided that this additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

g) Controller

The controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of processing are determined by Union or Member State law, that law may provide for the controller or the specific criteria for its nomination.

h) Processor

A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

i) Recipient

A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. However, public authorities that may receive personal data in the context of a particular inquiry under Union or Member State law are not regarded as recipients.

j) Third party

A third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

k) Consent

Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of their personal data, either through a statement or a clear affirmative action.

Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

one.point.five TPRM Consulting & Services GmbH

Ernst-Grote-Straße 23

30916 Isernhagen

Tel.: 0511373 853 11

Email: info@tprm-consult.de

Website: www.tprm-consult.de/

Name and contact details of the Data Protection Officer

Mr Niklas Georg

Ernst-Grote-Straße 23

30916 Isernhagen

Germany

Tel.: +49 151 43360237

Email: n.georg@tprm-consult.de

Collection of general data and information

Our websites collect a range of general data and information whenever a data subject or an automated system accesses them. This general data and information is stored in the log files of the relevant server. The information collected may include: (1) the browser types and versions used; (2) the operating system used by the accessing system; (3) the website from which an accessing system reaches our websites, known as the referrer; (4) the subpages accessed on our websites; (5) the date and time of access; (6) an Internet Protocol address (IP address); (7) the internet service provider of the accessing system; and (8) other similar data and information used to prevent threats in the event of attacks on our information technology systems.

This information is used to provide the websites technically, analyse errors and ensure the stability and security of the systems used. Where IP addresses or other information relate to an identifiable person, we treat them as personal data. Where the technical configuration provides for this, server log files are processed separately from information actively submitted by visitors.

The purposes of processing are to prevent threats, ensure IT security and fulfil the purposes mentioned above. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is, in particular, the protection of our information technology systems. Log files are deleted once the stated purposes have been fulfilled.

Contact via the website and other data submissions

Our website provides forms for general enquiries, seminar registrations and job applications. When you use these forms, we process the information you enter and, where applicable, any additional documents you submit. According to information provided internally, the submitted information is received in our email inbox and is also stored in our HubSpot system for contact management. Access is granted to the persons responsible for handling the submission. Further details about job applications and seminars can be found in the relevant sections.

Where contact enquiries relate to entering into or performing a contract with the person making the enquiry, they are processed on the basis of Article 6(1)(b) GDPR. Other enquiries are processed on the basis of our legitimate interest in handling and responding to enquiries under Article 6(1)(f) GDPR. Where consent is required for a particular processing activity, we obtain it separately under Article 6(1)(a) GDPR.

Contacting us does not, in itself, constitute separate consent to the transfer of data to third countries. Whether such a transfer takes place when handling an enquiry, and the basis on which it is permitted, depend on the recipients actually involved and the provisions of Articles 44 et seq. GDPR.

Routine erasure and restriction of personal data

We process and store personal data for the period necessary to fulfil the purpose of processing, where required by laws or regulations enacted by the European legislator or another legislator to which we are subject, or for as long as a legal basis for processing exists.

If the purpose of processing no longer applies, a retention period prescribed by the European legislator or another competent legislator expires, or the legal basis for processing ceases to apply, the personal data is routinely erased or its processing restricted in accordance with the applicable legal provisions.

Rights of data subjects under the GDPR

a) Right to confirmation

Every data subject has the right to obtain confirmation from the controller as to whether personal data concerning them is being processed.

Data subjects may contact us at any time to exercise this right.

b) Right of access

Every data subject has the right to obtain, at any time and free of charge, information from the controller about the personal data held about them and a copy of that data. The European legislator has also granted data subjects the right to obtain the following information:

The purposes of processing.
The categories of personal data being processed.
The recipients or categories of recipients to whom personal data has been or will be disclosed, particularly recipients in third countries or international organisations.
Where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period.
The existence of the right to request rectification or erasure of personal data, restriction of processing by the controller, or to object to such processing.
The right to lodge a complaint with a supervisory authority.
Where personal data was not collected from the data subject, all available information about its source.
The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of that processing for the data subject.

Data subjects also have the right to be informed whether their personal data has been transferred to a third country or an international organisation. Where this is the case, they have the right to be informed of the appropriate safeguards relating to the transfer.

Data subjects may contact us at any time to exercise this right.

c) Right to rectification

Every data subject has the right to request that inaccurate personal data concerning them be rectified without undue delay. Taking into account the purposes of processing, they also have the right to have incomplete personal data completed, including by providing a supplementary statement.

Data subjects may contact us at any time to exercise this right.

d) Right to erasure (‘right to be forgotten’)

Every data subject has the right to request that the controller erase personal data concerning them without undue delay where one of the following grounds applies and processing is not necessary:

The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
The data subject withdraws the consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
The data subject objects to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or the data subject objects to processing under Article 21(2) GDPR.
The personal data has been unlawfully processed.
The personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject.
The personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If any of the above grounds applies and a data subject wishes to request the erasure of personal data held by us, they may contact us at any time.

Where we have made personal data public and our organisation, as controller, is required to erase it under Article 17(1) GDPR, we take reasonable steps, including technical measures, taking account of available technology and the cost of implementation, to inform other controllers processing that published data that the data subject has requested the erasure of any links to, or copies or replications of, that personal data, insofar as processing is not necessary.

e) Right to restriction of processing

Every data subject has the right to request that the controller restrict processing where one of the following conditions applies:

The data subject contests the accuracy of the personal data, for a period enabling the controller to verify its accuracy.
The processing is unlawful and the data subject opposes erasure of the personal data, requesting restriction of its use instead.
The controller no longer needs the personal data for the purposes of processing, but the data subject requires it to establish, exercise or defend legal claims.
The data subject has objected to processing under Article 21(1) GDPR, pending verification of whether the controller’s legitimate grounds override those of the data subject.

If any of the above conditions applies and a data subject wishes to request restriction of the processing of personal data held by us, they may contact us at any time.

f) Right to data portability

Every data subject has the right to receive the personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format. They also have the right to transmit that data to another controller without hindrance from the controller to which it was originally provided, where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR, and is carried out by automated means, provided that processing is not necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller.

When exercising their right to data portability under Article 20(1) GDPR, data subjects also have the right to have personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

Data subjects may contact us at any time to exercise this right.

g) Right to object

Every data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

If a data subject objects, we will no longer process their personal data unless we can demonstrate compelling legitimate grounds for processing that override their interests, rights and freedoms, or unless processing is necessary to establish, exercise or defend legal claims.

Where we process personal data for direct marketing purposes, data subjects have the right to object at any time to the processing of their personal data for such marketing. This also applies to profiling insofar as it is related to direct marketing. If a data subject objects to our processing of their personal data for direct marketing purposes, we will no longer process it for those purposes.

Data subjects also have the right, on grounds relating to their particular situation, to object to our processing of their personal data for scientific or historical research purposes or statistical purposes under Article 89(1) GDPR, unless processing is necessary for the performance of a task carried out in the public interest.

Data subjects may contact us at any time to exercise this right. In the context of using information society services, and notwithstanding Directive 2002/58/EC, data subjects may also exercise their right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling

Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, where the decision (1) is not necessary for entering into or performing a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and that law provides for suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

Where a decision (1) is necessary for entering into or performing a contract between the data subject and the controller or (2) is based on the data subject’s explicit consent, we implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests. These include, at a minimum, the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

Data subjects may contact us at any time to exercise this right.

i) Right to withdraw consent to data processing

Every data subject has the right to withdraw their consent to the processing of personal data at any time.

Data subjects may contact us at any time to exercise this right.

General purpose of processing, categories of data processed and categories of recipients

The general purpose of processing personal data is to handle all activities relating to the controller, customers, prospective customers, business partners, other contractual or pre-contractual relationships between these groups in the broadest sense, or the controller’s legal obligations. This general purpose applies where no more specific purposes have been stated for a particular processing activity.

The categories of personal data we process are customer data, prospective customer data, employee data, including applicant data, and supplier data. The categories of recipients of personal data are public bodies, external bodies, recipients involved in internal processing, recipients involved in processing within the corporate group, and other bodies.

A list of our processors and data recipients in third countries, and international organisations where applicable, is either published on our website or available from us free of charge on request.

Legal bases for processing

Article 6(1)(a) GDPR provides the legal basis for processing activities for which we obtain consent for a specific purpose. Where processing personal data is necessary to perform a contract to which the data subject is a party, for example where processing is necessary to supply goods or provide another service or consideration, the legal basis is Article 6(1)(b) GDPR. The same applies to processing necessary to take pre-contractual steps, such as responding to enquiries about our products or services. Where we are subject to a legal obligation requiring the processing of personal data, such as compliance with tax obligations, processing is based on Article 6(1)(c) GDPR.

In rare cases, processing personal data may be necessary to protect the vital interests of the data subject or another natural person. This could arise, for example, if a visitor were injured on our premises and their name, age, health insurance details or other information essential to protecting their life had to be disclosed to a doctor, hospital or other third parties. In that case, processing would be based on Article 6(1)(d) GDPR.

Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the legal basis is Article 6(1)(e) GDPR.

Finally, processing activities may be based on Article 6(1)(f) GDPR. This legal basis applies to processing not covered by any of the legal bases mentioned above, where processing is necessary for the legitimate interests of our company or a third party, provided that these are not overridden by the interests, fundamental rights and freedoms of the data subject. Such processing is permitted in particular because the European legislator expressly recognised it. In this respect, the legislator considered that a legitimate interest could, for example, exist where the data subject is a customer of the controller, as stated in the second sentence of Recital 47 GDPR.

Legitimate interests pursued by the controller or a third party and direct marketing

Where personal data is processed on the basis of Article 6(1)(f) GDPR and no more specific legitimate interests have been stated, our legitimate interest is to conduct our business for the benefit of our staff and shareholders.

We do not currently send newsletters and do not use email addresses obtained through seminar registrations for marketing. If we offer electronic direct marketing in future, we will first assess the applicable legal requirements and, in particular, obtain consent where required.

You may object at any time to any otherwise permissible processing of personal data for direct marketing purposes. Registering for a seminar does not constitute consent to receive marketing communications.

Period for which personal data is stored

The criterion used to determine the period for which personal data is stored is the applicable statutory retention period. Where no statutory retention period applies, the criterion is the contractual or internal retention period. Once that period expires, the relevant data is routinely deleted, provided that it is no longer required to perform or enter into a contract. This applies in particular to all processing activities for which no more specific criteria have been established.

Statutory or contractual requirements to provide personal data; necessity for entering into a contract; the data subject’s obligation to provide personal data; possible consequences of not providing it

Please note that providing personal data may be required by law, for example under tax regulations, or may arise from contractual provisions, such as requirements to provide details of the contracting party. In some cases, entering into a contract may require a data subject to provide personal data that we subsequently need to process. For example, a data subject is required to provide us with personal data where our organisation enters into a contract with them. Failure to provide that data would mean that the contract could not be concluded. Before providing personal data, the data subject must contact us. We will explain, on a case-by-case basis, whether providing the data is a statutory or contractual requirement or is necessary to enter into a contract, whether the data subject is obliged to provide it, and the consequences of not doing so.

Use of automated decision-making

As a responsible company, we do not normally use automated decision-making or profiling. If we do so in exceptional cases, we inform the data subject separately or through a subsection of this Privacy Notice on our website. In such cases, the following applies:

Automated decision-making, including profiling, may take place where it (1) is necessary for entering into or performing a contract between the data subject and us; (2) is authorised by Union or Member State law to which we are subject, and that law provides for suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or (3) is based on the data subject’s explicit consent.

In the cases referred to in Article 22(2)(a) and (c) GDPR, we implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests. In these cases, you have the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Where applicable, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject, will be included in this Privacy Notice.

Recipients in third countries, appropriate or suitable safeguards, and how to obtain a copy or find out where they are available

Under Article 46(1) GDPR, a controller or processor may transfer personal data to a third country only if the controller or processor has provided appropriate safeguards and enforceable data subject rights and effective legal remedies are available. Appropriate safeguards may be provided through standard data protection clauses without requiring specific authorisation from a supervisory authority, as set out in Article 46(2)(c) GDPR.

Transfers of personal data to countries outside the EU or EEA are subject to the requirements of Articles 44 et seq. GDPR. Depending on the recipient and the transfer, relevant mechanisms may include, in particular, adequacy decisions adopted by the European Commission under Article 45 GDPR or appropriate safeguards, such as EU Standard Contractual Clauses under Article 46 GDPR. The EU–U.S. Data Privacy Framework may apply to appropriately certified US companies. The mechanisms applicable in each case depend on the particular service provider and processing activity.

Article 45(3) GDPR authorises the European Commission to decide, by means of an implementing act, that a non-EU country ensures an adequate level of protection. This means a level of protection for personal data that is essentially equivalent to that within the EU. Adequacy decisions allow personal data to flow from the EU, as well as Norway, Liechtenstein and Iceland, to a third country without further obstacles. Similar provisions apply to the United Kingdom, Switzerland and certain other countries.

In all cases where the European Commission, or the government or competent authority of another country, has decided that a third country ensures an adequate level of protection and/or a valid framework exists, such as the EU–U.S. Data Privacy Framework, the Swiss–U.S. Data Privacy Framework or the UK Extension to the EU–U.S. Data Privacy Framework, all transfers by us to members of such frameworks, such as self-certified organisations, are based exclusively on that organisation’s participation in the relevant framework or on the applicable adequacy decisions. Where we or one of our group companies participate in such a framework, all transfers to us or that group company are based exclusively on the respective company’s participation in that framework. Where we or one of our group companies are based in a third country with an adequate level of protection, all transfers to us or that group company are based exclusively on the applicable adequacy decisions.

Every data subject may obtain a copy of the frameworks from us. The frameworks are also available in the Official Journal of the European Union, in published legislative materials, or on the websites of data protection supervisory authorities or other authorities or institutions.

Right to lodge a complaint with a data protection supervisory authority

You may exercise this right in particular with the data protection supervisory authority in the place of your habitual residence, your place of work or the place of the alleged infringement.

Data protection in job applications and the recruitment process

We collect and process applicants’ personal data as part of the recruitment process. Processing may also take place electronically, particularly where an applicant submits application documents to us electronically, for example by email or through a web form on our website or a third-party website.

The purpose of processing applicant data is to assess the application as part of the recruitment process. We process all data you provide for this purpose. Based on the data submitted with your application, we assess whether to invite you to an interview as part of the selection process. For applicants who are potentially suitable, we subsequently process certain additional personal data you provide, particularly during the interview, that is material to our selection decision.

The legal bases for processing are Article 6(1)(b), Article 9(2)(b) and (h), and Article 88(1) GDPR, together with national legal provisions.

If no employment relationship is established, we delete the application documents without undue delay after notifying the applicant of the rejection. Where, exceptionally, further retention is necessary to comply with a legal obligation or to establish, exercise or defend specific legal claims, data is retained only to the extent and for the period necessary for those purposes.

Registration or completion of forms on our website

Visitors to our website can use forms for general enquiries, seminar registrations and job applications. The data processed in each case depends on the form fields and the documents submitted. Form submissions are sent to our email inbox and also recorded in HubSpot for contact management. We use this data to handle the relevant request; any additional use for marketing purposes is subject to the separate information on marketing communications.

When you register or enter information on our website, the IP address assigned by your internet service provider (ISP), together with the date and time of registration or submission, may also be stored. This data is stored because it is necessary to prevent misuse of our services and, where required, to enable criminal offences to be investigated. Storing this data is therefore necessary for our protection. The purposes of processing are to prevent threats, detect misuse, investigate criminal offences and fulfil the purposes mentioned above. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is, in particular, to protect our information technology systems and investigate criminal offences. As a rule, this data is not disclosed to third parties unless disclosure is legally required or serves law enforcement purposes.

The processing of form submissions depends on their respective purpose. We process enquiries concerning a potential contract with the person making the enquiry and seminar bookings, where necessary, under Article 6(1)(b) GDPR. Other enquiries are processed on the basis of our legitimate interest in appropriate communication under Article 6(1)(f) GDPR. The processing of applicant data is explained in the section ‘Data protection in job applications and the recruitment process’. Submitting information does not, in itself, authorise its use for marketing communications.

Information submitted through forms is processed according to its purpose: where processing is necessary to take pre-contractual steps or perform a contract with the data subject, Article 6(1)(b) GDPR applies. Article 6(1)(f) GDPR may apply to other legitimate enquiries. Consent under Article 6(1)(a) GDPR is relied upon as a legal basis only where it has actually been obtained for the specific processing activity. Merely entering and submitting data does not constitute explicit consent to transfers to third countries under Article 49(1)(a) GDPR.

On request, we will inform any data subject at any time about the personal data we hold about them. We will also rectify or erase personal data at the data subject’s request or following information provided by them, provided that no statutory retention obligations or other grounds justifying processing prevent us from doing so. Any of our staff will be happy to assist you with this.

Cookies and similar technologies

Squarespace Analytics: We use Squarespace’s analytics functions to analyse our website statistically, for example to determine visitor numbers and page views. Under our configuration, non-essential analytics cookies are activated only after consent has been given. Squarespace documents possible analytics cookies including ss_cid, ss_cpvisit, ss_cvr, ss_cvisit and ss_cvt. Whether these cookies are used in a particular case depends on the configuration; they were not observed during our sample-based cookie check.

Our website uses technically necessary cookies and, subject to your consent, may use additional cookies for website analytics. The cookie banner offers the categories ‘Necessary’, ‘Performance and Analytics’ and ‘Advertising’. You can give consent by selecting ‘Accept all’, or make a selection or refuse consent through ‘Manage cookies’. The presence of the ‘Advertising’ category does not, in itself, demonstrate that advertising tracking is actually used. Access to information on users’ devices is governed by Section 25 TDDDG; strictly necessary cookies are exempt under Section 25(2) TDDDG. For analytics activities requiring consent, we base the processing of personal data on Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future; you can contact us using the details provided for this purpose.

Google Analytics 4 (GA4)

Google Analytics 4 (GA4) is used for statistical analysis of how our website is used. During a sample-based browser check, the cookies ga and ga_<ID> were set after consent had been given, but not before. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by other Google companies or subcontractors outside the EEA may take place.

Google Analytics may process pseudonymous identifiers, information about page views and sessions, approximate location information, and browser and device data. Under our configuration, non-essential cookies are used only with consent under Section 25(1) TDDDG; the associated analysis involving personal data is based on Article 6(1)(a) GDPR. Consent may be withdrawn with effect for the future. Comparing cookies alone does not allow a conclusive assessment of possible cookieless network transmissions.

Google specifies a default lifetime of up to two years for ga and ga_<ID>; the actual duration may vary depending on the settings. This is distinct from the retention of Analytics reporting data. For transfers to third countries, relevant adequacy decisions and appropriate safeguards under Articles 45 and 46 GDPR may apply, depending on the recipient. Further information: https://support.google.com/analytics/answer/11397207?hl=de and https://policies.google.com/privacy?hl=de.

The following cookies were observed during the sample-based website check: crumb, a Squarespace cookie protecting against abusive requests, which was present before consent; and, after consent, ga and ga_<ID> for Google Analytics usage analysis, together with ss_marketingcookiesAllowed and ss_performancecookiesAllowed, which Squarespace uses to store cookie preferences. These last two cookies do not demonstrate that advertising tracking is active.

Seminar registrations and delivery of events

You can register for seminars and professional development events through our website. We process the contact details entered in the registration form, information about the chosen event and, where applicable, any further information required for registration. According to information provided internally, this information is sent to our email inbox and also stored in HubSpot for contact management.

The purposes of processing are to handle registrations and to organise, deliver and, where applicable, invoice the event. Where the data subject registers on a contractual basis, Article 6(1)(b) GDPR applies; in other circumstances, the applicable legal bases must be assessed separately.

We use the data collected through seminar registrations exclusively to process the registration and organise and deliver the relevant seminar. This includes, in particular, registration confirmations, invitations and event-related information, as well as invoicing and compliance with legal obligations where necessary. The data is not used for advertising or newsletters; we do not currently send a newsletter.

Use of HubSpot for contact management

We use HubSpot exclusively to manage customer and prospective customer contacts and to handle contact enquiries and seminar registrations. Under our configuration, HubSpot is not used to track website visitors’ behaviour. Form submissions are received in our email inbox and also recorded in HubSpot.

The data processed may include, in particular, names, business contact details, company information, and the content and history of enquiries or seminar registrations. The information recorded in each case depends on the relevant contact and form.

The company operating the service, and therefore the recipient of the personal data, is HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA. For data subjects in the EU and EEA, HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland, acts as the contact point and representative within the meaning of Article 27 GDPR. The representative under UK national law is HubSpot UK, 199 Bishopsgate, London EC2M 3T, United Kingdom.

Processing serves to handle and organise contact enquiries and business relationships. Where data is necessary to enter into or perform a contract with the data subject, Article 6(1)(b) GDPR applies. Otherwise, contact management is based on our legitimate interest in efficiently handling and documenting business contacts under Article 6(1)(f) GDPR. Where we use data for email marketing, the separately described requirements apply.

HubSpot’s processing of personal data is governed by the data protection provisions incorporated into its customer terms and the provider’s Data Processing Agreement (DPA). Depending on the services and subprocessors used, transfers to third countries, particularly the USA, may take place. Relevant adequacy decisions, such as those applying to certified US companies under the EU–U.S. Data Privacy Framework, or appropriate safeguards such as EU Standard Contractual Clauses, may apply. Further information is available at https://legal.hubspot.com/dpa.

We retain contact data only for as long as it is needed to handle the relevant enquiry, maintain the business relationship or comply with statutory retention obligations. Where retention is no longer necessary and no other legal basis exists, the data is deleted. Fixed, uniform deletion periods have not yet been established for certain types of data.

Further information and HubSpot’s applicable privacy terms are available at https://legal.hubspot.com.

Data protection provisions concerning the use of Microsoft Teams

We use Microsoft Teams to conduct meetings and discussions with, among others, customers, applicants and seminar participants. This may involve processing names, contact details, meeting metadata and information shared during the meeting. Under our internal policy, recordings are made only with the prior consent of the data subjects concerned. The use of automatic transcription and the retention periods for any recordings still require a separate review.

When Microsoft Teams is used, personal data such as names, email addresses, telephone numbers, usage data, including meeting times and durations and chat logs, content data, including files, notes and messages, and location data is processed. This information is necessary to provide the services, improve the user experience, provide support, and ensure the security and compliance of the services.

The company operating the service, and therefore the recipient of the personal data, is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. For data subjects in the EU and EEA, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, acts as the contact point and representative within the meaning of Article 27 GDPR. The representative under UK national law is Microsoft Limited, Microsoft Campus, Thames Valley Park, Reading, RG6 1WG, United Kingdom. The representative in Switzerland under Article 14 of the Federal Act on Data Protection (FADP) is Microsoft Schweiz GmbH, Seestraße 356, 8038 Zürich, Switzerland.

Purposes for which personal data is processed and the legal basis for processing: the purpose is to use, provide, manage and improve Microsoft Teams for communication. Processing is based on the performance of a contract to which the data subject is a party under Article 6(1)(b) GDPR, and on legitimate interests under Article 6(1)(f) GDPR, such as improving our services and using and providing modern communication tools.

The company operating the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or on other appropriate or suitable safeguards referred to in Article 46(2) GDPR. The company operating the service may be a certified participant in one or more of the Data Privacy Frameworks. Further details are available at https://www.dataprivacyframework.gov/list. You may request a copy of the appropriate or suitable safeguards from us.

The criteria used to determine how long personal data is processed are the contractual relationship between us and the company operating the service, or statutory or contractual retention periods. Providing personal data is neither a statutory nor a contractual requirement, nor is it necessary to enter into a contract. You are not obliged to provide personal data to us or to the company operating the service. However, if you do not provide it, you may be unable to use our services or those of the company operating the service.

Further information and the applicable privacy provisions for Microsoft Teams are available at https://privacy.microsoft.com.

Website hosting by Squarespace and domain management through STRATO

Our website is operated through Squarespace. Squarespace provides the technical website platform, including content delivery. The domain is managed through STRATO. According to the information available to us, STRATO does not provide the website hosting.

When you access our website, technically necessary information is processed, particularly your IP address, the time of access, the content requested, and technical information about your browser and device. This serves to provide the website, maintain security and resolve technical errors. The specific retention periods for technical server data depend on the Squarespace configuration actually used and the applicable provider provisions.

Squarespace provides the website platform. STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, is used for domain registration and management. Information about Squarespace is available at https://www.squarespace.com/privacy and https://de.squarespace.com/dpa.

The technical provision and security of our website are based on our legitimate interest in maintaining a secure and functional online presence under Article 6(1)(f) GDPR. Cookies and similar technologies that are not technically necessary are subject to the consent requirements described in the section on cookies. STRATO is used for domain management within the scope of our contractual relationship.

The Squarespace Data Processing Addendum (DPA) forms part of its standard terms of service. Squarespace provides for international data transfers for certain processing activities, including possible transfers to the USA. Where applicable, adequacy decisions, particularly the EU–U.S. Data Privacy Framework for appropriately certified recipients, and appropriate safeguards such as EU Standard Contractual Clauses may apply. Details are available at https://de.squarespace.com/dpa.

Privacy information: Squarespace https://www.squarespace.com/privacy; STRATO https://www.strato.de/datenschutz/.

Email newsletters and marketing

We do not currently send newsletters. Contact details obtained through contact enquiries, job applications and seminar registrations are not used for marketing newsletters.

If we offer newsletters or other email marketing in future, we will first ensure that the necessary data protection and competition law requirements are met and update this Privacy Notice accordingly.

Link to our LinkedIn company profile

Our website contains a link to our LinkedIn company profile. According to information provided internally, we do not use the LinkedIn Insight Tag or any LinkedIn tracking technology on the website. The link alone does not automatically embed LinkedIn content when you visit our website.

If you click the link, you will leave our website and be taken to LinkedIn. From that point onwards, LinkedIn may process personal data in accordance with its own privacy policy. Additional responsibilities may arise in relation to content and interactions on our company profile.

Information about the provider and data protection at LinkedIn is available at https://www.linkedin.com/legal/privacy-policy.

We use LinkedIn to present our company and communicate with prospective customers and business partners. Where we process personal data ourselves on our profile, we do so on the basis of our legitimate interest in professional public relations and communication under Article 6(1)(f) GDPR, subject to any other applicable legal bases.

Any data transfers carried out by LinkedIn after you access the linked platform are governed by LinkedIn’s information and applicable transfer mechanisms. According to the information available to us, no LinkedIn tracking code is used on our website.

We store or process personal messages and interactions with our company profile insofar as necessary for communication and compliance with legal obligations. Retention depends on the relevant purpose and any applicable statutory periods.

Further information about LinkedIn: https://www.linkedin.com/legal/privacy-policy.