Privacy policy

Contents

This English version is provided for convenience only. The German version is legally binding.

1. 1Controller
2. 2Overview of processing
3. 3Relevant legal bases
4. 4Security measures
5. 5Recipients and disclosure of personal data
6. 6International data transfers
7. 7Retention and erasure
8. 8Rights of data subjects
9. 9Provision of the website and hosting
10. 10Browser storage, cookies and third-party content
11. 11Contacting us and contact form
12. 12Applications by email
13. 13Business services
14. 14Company profiles on social networks and external links
15. 15Requirement to provide data, source of data, no automated decision-making
16. 16Amendments and updates to this privacy policy

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

DIP Deutsche IT und Projektberatungsgesellschaft mbH, Rahmannstraße 11, 65760 Eschborn, Germany

Email: info@dip-consulting.de · Phone: +49 (0) 6196 58666 20

Represented by its managing director, Manuel Fernandez. If you have any questions about data protection or wish to exercise your rights, you can reach us using the contact details above.

2. Overview of processing

The following overview summarizes the types of data processed, the data subjects concerned and the purposes of processing. Details can be found in sections 9 to 14.

3. Relevant legal bases

We process personal data on the basis of the following provisions of the GDPR. We state the legal basis applicable in each case for the respective processing.

• Consent (Art. 6(1)(a) GDPR) – you have given consent to the processing for one or more specific purposes.
• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR) – processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.
• Legal obligation (Art. 6(1)(c) GDPR) – processing is necessary for compliance with a legal obligation to which we are subject (e.g., retention obligations under commercial and tax law).
• Legitimate interests (Art. 6(1)(f) GDPR) – processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. We state the respective legitimate interest for each processing operation.

4. Security measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR).

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, its input and disclosure, as well as procedures for the exercise of data subject rights, the erasure of data and responses to threats. We take the protection of personal data into account when selecting and designing software and procedures (data protection by design and by default, Art. 25 GDPR). For example, this website is implemented as a static website that loads no third-party content and works without cookies or tracking (section 10).

TLS encryption (HTTPS): Data transmitted between your browser and this website, including entries in the contact form, is encrypted using TLS. You can recognize an encrypted connection by “https://” in your browser’s address bar.

Please note that communication by email may be subject to security gaps during transmission. We do not offer end-to-end encryption of emails.

5. Recipients and disclosure of personal data

We only transfer or disclose personal data where this is necessary for the purposes stated in this privacy policy, a legal basis exists and the legal requirements are complied with.

Recipients may include, in particular: our hosting provider Netlify (section 9) and service providers that support us in operating our IT and our email communication. Such service providers act as processors solely on our instructions; we conclude the agreements required under Art. 28 GDPR with them. In the context of business relationships, tax and legal advisors, banks and public authorities may also be recipients where this is necessary for the performance of contracts or to comply with legal obligations (section 13).

When paid consulting formats (e.g. expert sessions) are booked, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, is an additional recipient for payment processing (section 13). We create invoices ourselves and send them to you by email.

Within our company, only those persons who need your data to perform their respective tasks have access to it.

6. International data transfers

Processing in a third country (outside the European Union and the European Economic Area) may take place in particular when services based in the USA are used. This concerns our hosting provider Netlify, Inc. (section 9) and may be the case when you use social networks (section 14). For payments via PayPal, PayPal may also transfer data to affiliated companies outside the EU in accordance with its own terms (section 13).

Such transfers only take place subject to the requirements of Art. 44 et seq. GDPR. Where an adequacy decision of the European Commission exists for the third country (Art. 45 GDPR), it serves as the basis. For the USA, this applies under the EU-U.S. Data Privacy Framework (adequacy decision of July 10, 2023) to companies certified under it; the list of certified companies is available at https://www.dataprivacyframework.gov/. Otherwise, transfers only take place if an adequate level of data protection is ensured by other means, in particular by EU standard contractual clauses (Art. 46(2)(c) GDPR), or if a derogation under Art. 49 GDPR applies.

Further information on third-country transfers and adequacy decisions is provided by the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

7. Retention and erasure

We store personal data only for as long as is necessary for the respective purpose. If the purpose no longer applies or you withdraw your consent, we erase the data unless a statutory retention obligation or another legal reason, such as the establishment, exercise or defense of legal claims, requires further storage. In such cases, we restrict processing to these purposes and erase the data once the respective period has expired.

Statutory retention obligations arise in particular from German commercial and tax law (Section 257 of the German Commercial Code – HGB, Section 147 of the German Fiscal Code – AO): ten years for books of account, inventories, opening balance sheets, annual financial statements and management reports, eight years for accounting vouchers and six years for commercial and business letters received and sent. Each period begins at the end of the calendar year in which the document was created.

Information on the retention period for individual processing operations can be found in sections 9 to 13.

8. Rights of data subjects

Under the GDPR, in particular Art. 15 to 21 GDPR, you have the following rights, subject to the respective statutory requirements:

• Right of access (Art. 15 GDPR): You may request confirmation as to whether we process data concerning you, as well as access to this data, further information and a copy of the data.
• Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate data and the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You may request that data concerning you be erased without undue delay.
• Right to restriction of processing (Art. 18 GDPR): As an alternative to erasure, you may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): You may receive the data you have provided to us in a structured, commonly used and machine-readable format or request that it be transmitted to another controller.
• Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit – HBDI), Wiesbaden, www.datenschutz.hessen.de.

9. Provision of the website and hosting

This website is hosted by Netlify, Inc., San Francisco, USA. Netlify delivers the pages, fonts, images and PDF downloads of this website and forwards requests from the forms on this website to us (section 11). Netlify acts as our processor (Art. 28 GDPR). For transfers to the USA, see section 6.

In order to transmit the content of the website to your browser, your IP address is processed. In addition, access is recorded in server logs (log files). These may include: IP address, date and time of access, page or file requested, amount of data transferred, notification of successful retrieval (HTTP status code), previously visited page (referrer), and browser type and version and operating system (user agent).

The purpose is to deliver the website and to ensure its stability and security, for example to prevent overload and to prevent and investigate abusive access (e.g., DDoS attacks). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure, stable and reliable provision of the website. The data is not used to create user profiles.

Log data is stored only for as long as necessary for these purposes and is then erased or anonymized. Data whose further retention is required for evidentiary purposes is exempt from erasure until the respective incident has been finally resolved.

10. Browser storage, cookies and third-party content

If you switch between light and dark mode using the toggle in the header, we store your choice (“light” or “dark”) under the key “dip-theme” in your browser’s local storage (localStorage) so that the display is retained on your next visit. Nothing is stored unless you click the toggle. The value is not transmitted to us and remains stored until you delete it via your browser settings.

This storage is strictly necessary to provide the function you have expressly requested; consent is therefore not required under Section 25(2) No. 2 TDDDG. To the extent personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in retaining the display you have chosen.

Beyond this, we do not use cookies or any analytics, tracking or marketing services. A consent management tool (cookie banner) is therefore not required and is not used.

We do not embed any third-party content, plugins or functions (e.g., videos, maps, social media plugins or fonts from external providers). The font used is delivered together with the website by our hosting provider; no data is transmitted to other providers when you access the website. The only exception is the PayPal payment button when booking a consulting format: it is only loaded when you click “Continue to payment” in the booking form (section 13).

11. Contacting us and contact form

When you contact us (e.g., by email, phone, WhatsApp, post, via the contact form or via social networks) and in the context of existing business relationships, we process your information to the extent necessary to handle and respond to your request and any measures requested. This includes, in particular, contact data, content data and the time and communication data of the request.

In the request form (“I’d like to learn more”), first name, last name, email address and your message are mandatory; phone number and company are optional, and you also choose a topic. In addition, the form transmits whether you submitted it on the German or the English page. Your entries are received by our hosting provider Netlify (section 9), not stored there, and forwarded by email via our email system (Microsoft 365) to our mailbox, where we process your request. To prevent automated spam submissions, the form contains a control field that is invisible to visitors.

Appointment requests (“Book a free initial call”): we process first name, last name, email address, preferred day and time and, optionally, phone number, company and your topic. The request is stored as a case with our hosting provider Netlify (section 9) and forwarded by email to our appointments mailbox. Acceptance, counter-proposals or declines are made via personal links in the emails; confirmations include a calendar entry (ICS file). The case is deleted automatically no later than 90 days after the request; emails in our mailbox are subject to the general erasure periods (section 7).

The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to requests and communicating with prospective customers and business partners.

We erase your information once your request has been conclusively dealt with and no further communication is expected, unless statutory retention obligations (e.g., for business letters, section 7) prevent this.

12. Applications by email

We accept applications exclusively by email to apply@dip-consulting.de. Application documents cannot be uploaded or submitted via a form on this website.

We process the data you send us with your application, in particular master and contact data, communication data and content data such as your cover letter, CV, references and certificates of qualification, as well as your earliest possible start date. The purpose is to conduct the application procedure and to decide on the establishment of an employment relationship.

The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG and, where you have consented to processing, Art. 6(1)(a) GDPR. If you voluntarily provide special categories of personal data (e.g., information on a severe disability), we process such data only to the extent necessary for the application procedure (Art. 9(2)(b) GDPR).

Your documents are accessible only to the persons involved in the selection decision. If no employment relationship is established, we erase the documents after the procedure has been completed. Longer retention only takes place where it is necessary to defend against possible legal claims (e.g., under the German General Equal Treatment Act – AGG) (Art. 6(1)(f) GDPR), where statutory retention obligations apply or where you have consented to longer storage. If an employment relationship is established, the data required for the employment relationship is transferred to the personnel file.

Please only send the documents required for your application; regarding transmission by email, please note the information in section 4.

13. Business services

We process data of our customers, prospective customers and other business and contractual partners in the context of contractual and pre-contractual relationships, for example to respond to requests, to provide our consulting and IT services, for invoicing and for company organization. This includes, in particular, master, contact, contract and payment data.

The legal bases are Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations, e.g., retention obligations) and Art. 6(1)(f) GDPR; our legitimate interest lies in proper business management and in safeguarding our rights.

We inform you before or at the time of collection which data is required for concluding or performing a contract. We only disclose data where this is necessary for the performance of the contract or to comply with legal obligations (section 5).

Booking paid consulting formats (e.g. expert sessions): We process first name, last name, email address, company and billing address, optionally phone number and VAT ID, topic and question, three preferred dates, the preferred meeting format and payment and booking data (amount, payment status, payment and invoice number). The booking is stored as a record with our hosting provider Netlify (section 9) and forwarded by email to our appointment mailbox; confirmation, alternative proposal, cancellation and reminders are sent by email with personal links.

Payment processing via PayPal: For payment you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. You enter your payment details directly with PayPal; we do not receive them. We transmit the amount, a description of the service and a reference number to PayPal and receive the payment status and a payment ID from PayPal. PayPal is an independent controller for processing in connection with the payment; PayPal’s privacy statement applies: https://www.paypal.com/de/legalhub/privacy-full. The legal basis is Art. 6(1)(b) GDPR.

Integration of the PayPal payment button (PayPal JavaScript SDK): We only load the payment button when you click “Continue to payment” in the booking form – not when the page is opened. From that moment, your browser loads program code and content directly from PayPal servers (www.paypal.com); in particular, your IP address, browser and device information and, where applicable, cookies or similar technologies set by PayPal are transmitted to PayPal, which PayPal uses to process the payment and to prevent fraud. The legal basis is Art. 6(1)(b) GDPR (initiation and performance of the contract); access to your device is permitted under § 25(2) no. 2 TDDDG because it is strictly necessary for the service you have expressly requested – the payment. If you do not load the payment button, no data is transmitted to PayPal.

Invoicing: We create the invoice ourselves from name, company, billing address, VAT ID (if provided) and the booking data and send it to you as a PDF by email. The legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (tax obligations regarding invoicing and retention, section 7).

We erase the data after the expiry of statutory warranty, limitation and retention periods (section 7).

14. Company profiles on social networks and external links

We maintain company profiles on LinkedIn and XING in order to provide information about our company there and to communicate with users. On our website, we only refer to these profiles by means of simple links; no social media plugins are embedded. Therefore, no data is transmitted to these networks when you visit our website.

We also provide a simple link that allows you to message us via WhatsApp (WhatsApp Ireland Limited, part of the Meta group) at our phone number. No WhatsApp script or widget is embedded on our website for this purpose; data is only transmitted once you click the link. It is your choice whether to contact us this way; alternatively, you can reach us by email, phone or the contact form.

If you follow a link or visit our profiles, the respective operator processes your data in accordance with its own privacy policy. Operators of social networks generally also process user data for market research and advertising purposes and may create usage profiles based on usage behavior, in particular if you are logged in. Data may also be processed outside the European Union, which may, for example, make it more difficult to enforce your rights.

Where we are jointly responsible with the operator for the processing of data when you visit our profiles (Art. 26 GDPR), for example for page statistics (“Page Insights”) on LinkedIn, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing information about our company and communicating with users. Access requests and other data subject rights can be asserted most effectively directly with the operator, as only the operator has access to the user data. However, you may also contact us at any time.

• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; privacy policy: https://www.linkedin.com/legal/privacy-policy; joint controller addendum for page statistics: https://legal.linkedin.com/pages-joint-controller-addendum; opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• XING: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; privacy policy: https://privacy.xing.com/de/datenschutzerklaerung (German).

15. Requirement to provide data, source of data, no automated decision-making

There is no statutory obligation to provide us with personal data. However, the website cannot be displayed without the technically necessary connection data (section 9). Without the data marked as mandatory, we cannot process your request via the contact form, and without the information required for an application, we cannot consider your application. Where data is required for concluding or performing a contract, we will inform you of this (section 13).

We generally process data that you provide to us yourself or that arises technically when you use the website.

No solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

16. Amendments and updates to this privacy policy

This privacy policy was last updated in October 2026. We will amend it as soon as changes to our data processing make this necessary, and we will inform you as soon as such changes require action on your part (e.g., consent) or any other individual notification. Please therefore review the content of this privacy policy regularly.

Where we provide addresses and contact information of other companies, please note that these may change over time; please check the information before contacting them.