Privacy.

This privacy policy explains what kinds of personal data we process, for what purposes and to what extent. It applies to all processing of personal data carried out by us, both in the course of providing our services and in particular on our websites, in mobile applications and within external online presences such as our social media profiles (together referred to as our “online offering”).

Legal text by Dr. Schwenke, adapted. In the event of any discrepancy, the German version of this privacy policy prevails.

Minerva Strategic Consulting GmbH

Geraldine-Juliane Stenzel, LL.M.

Biesheimring 3, 14167 Berlin, Germany

Email: info@minerva-consulting.eu

Telephone: +49 30 923 70 200

Legal notice: minerva-consulting.eu/legal-notice

The following overview summarises the types of data processed, the purposes of processing and the categories of data subjects.

• ›Master data
• ›Payment data
• ›Contact data
• ›Content data
• ›Contract data
• ›Usage data
• ›Meta, communication and procedural data
• ›Applicant data

• ›Clients
• ›Employees
• ›Prospective clients
• ›Communication partners
• ›Users
• ›Applicants
• ›Business and contractual partners
• ›Participants
• ›Persons depicted

• ›Provision of contractual services and fulfilment of contractual obligations
• ›Enquiries and communication
• ›Security measures
• ›Direct marketing
• ›Office and organisational procedures
• ›Managing and responding to enquiries
• ›Application procedures
• ›Feedback
• ›Marketing
• ›Provision of our online offering and user experience
• ›Information technology infrastructure

Legal bases under the GDPR: below is an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the GDPR, national data protection requirements may apply in your or our country of residence or establishment. Where more specific legal bases apply in an individual case, we will state them in this privacy policy.

• ›Consent (Art. 6(1)(a) GDPR) – the data subject has given consent to the processing of their personal data for one or more specific purposes.
• ›Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR) – processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• ›Legal obligation (Art. 6(1)(c) GDPR) – processing is necessary for compliance with a legal obligation to which the controller is subject.
• ›Legitimate interests (Art. 6(1)(f) GDPR) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National provisions in Germany: in addition to the GDPR, national data protection rules apply in Germany, in particular the Federal Data Protection Act (BDSG). It contains special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, transmission and automated decision-making including profiling. State data protection acts may also apply.

Swiss Federal Act on Data Protection: if you are located in Switzerland, we process your data on the basis of the Swiss FADP. We process personal data only where processing is lawful, carried out in good faith and proportionate (Art. 6(1) and (2) Swiss FADP).

In accordance with legal requirements and taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include securing the confidentiality, integrity and availability of data by controlling physical and electronic access to it, as well as access, input, disclosure, availability and separation. We have also established procedures that ensure the exercise of data subject rights, the erasure of data and responses to threats to data.

Shortening of IP addresses: where IP addresses are processed by us or by the service providers and technologies we use, and processing a full IP address is not necessary, the IP address is shortened (also referred to as IP masking).

TLS encryption (https): to protect the data you transmit via our online offering, we use TLS encryption. You can recognise such connections by the prefix https:// in the address bar of your browser.

In the course of our processing of personal data, it may occur that data is transferred to, or disclosed to, other bodies, companies, legally independent organisational units or persons. Recipients may include, for example, service providers tasked with IT services or providers of services and content integrated into a website. In such cases we comply with legal requirements and in particular conclude appropriate contracts or agreements with the recipients of your data.

Processing in third countries: where we process data in a third country, that is outside the European Union or the European Economic Area, or where processing takes place in the context of using third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is done only in accordance with legal requirements. Where the level of data protection in the third country has been recognised by an adequacy decision (Art. 45 GDPR), this serves as the basis for the transfer. Otherwise, transfers take place only where the level of data protection is otherwise safeguarded, in particular by standard contractual clauses (Art. 46(2)(c) GDPR), express consent, or where transfer is contractually or legally required (Art. 49(1) GDPR).

EU-US Data Privacy Framework: under the Data Privacy Framework, the European Commission recognised the level of data protection of certain companies in the United States as adequate in its decision of 10 July 2023. The list of certified companies is available at dataprivacyframework.gov.

The data we process is erased in accordance with legal requirements as soon as the consent permitting processing is withdrawn or other permissions cease to apply, for example where the purpose of processing no longer applies or the data is no longer required for that purpose. Where data is not erased because it is required for other, legally permissible purposes, processing is restricted to those purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the establishment, exercise or defence of legal claims.

Rights under the GDPR: as a data subject you have various rights, which arise in particular from Articles 15 to 21 GDPR.

• ›Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where personal data is processed for direct marketing purposes, you have the right to object at any time.
• ›Right to withdraw consent: you have the right to withdraw any consent given at any time.
• ›Right of access: you have the right to request confirmation as to whether data concerning you is being processed, and to obtain access to that data together with further information and a copy of the data.
• ›Right to rectification: you have the right to request the completion of data concerning you or the rectification of inaccurate data.
• ›Right to erasure and restriction of processing: you have the right to request that data concerning you be erased without delay, or alternatively to request a restriction of processing.
• ›Right to data portability: you have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
• ›Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Rights under the Swiss FADP: you have the right of access, the right to data release or transfer, the right to rectification and the right to object to processing and to request erasure or destruction of your data.

This website uses no cookies for analytics, marketing or tracking purposes. Only strictly necessary storage is used:

• ›Your choice in the notice banner is stored in your browser’s local storage so that the notice does not reappear on every visit. This entry remains on your device and is not transmitted to us or to any third party.
• ›A session identifier (PHPSESSID) is set only when the contact form is submitted. It protects against automated bulk submissions and is deleted when you close your browser.

Both are strictly necessary for the functions you have requested and therefore do not require consent under section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can change your choice at any time via Cookie settings in the footer, and delete local storage and cookies in your browser settings at any time.

Legal bases: legitimate interests (Art. 6(1)(f) GDPR), performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

In the course of our business we use additional services, platforms, interfaces and plug-ins from third-party providers in accordance with legal requirements. Their use is based on our interest in the proper, lawful and economical operation of our business and internal organisation.

Lexoffice: online software for invoicing, accounting, banking and tax filing with document storage; provider: Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany; legal basis: legitimate interests (Art. 6(1)(f) GDPR).

We process users’ data in order to provide our online services. For this purpose we process the user’s IP address, which is necessary in order to transmit the content and functions of our online services to the user’s browser or device.

Access data and log files: access to our online offering is recorded in the form of server log files. These may include the address and name of the pages and files retrieved, the date and time of retrieval, volumes of data transferred, notification of successful retrieval, browser type and version, the operating system, the referrer URL and, as a rule, IP addresses and the requesting provider. Log file information is stored for a maximum of 30 days and then deleted or anonymised.

Email dispatch and hosting: the web hosting services we use also include the sending, receipt and storage of emails. Please note that emails are generally not sent in encrypted form over the internet. As a rule they are encrypted in transit, but not on the servers from which they are sent and received.

SiteGround: our website is hosted with SiteGround, which provides storage space, computing capacity and the associated infrastructure; provider: SiteGround Hosting EOOD, 6 Olimpiyska Str., 1166 Sofia, Bulgaria, and SiteGround Spain S.L.; server location: European Union; a data processing agreement is in place; legal basis: legitimate interests (Art. 6(1)(f) GDPR).

When you contact us, for example by post, contact form, email, telephone or via social media, the details provided by the enquiring person are processed to the extent necessary to respond to the enquiry and any measures requested.

Contact form: the form on this website is our own development; no third-party service is used. Name, email address and message are collected as mandatory fields, with company and telephone number provided voluntarily. The details are transmitted by email to info@minerva-consulting.eu only and are not stored in a database on the server. Transmission is encrypted via TLS.

Protection against misuse: to prevent automated submissions we use a field invisible to humans and a short waiting period between submissions. No data is transferred to third parties; in particular, no captcha service is used.

Retention: enquiries received by email are deleted once they have been dealt with conclusively and no statutory retention obligations apply, and at the latest upon expiry of the commercial and tax law retention periods.

Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

We use messenger services for communication. You can also reach us by other means, for example by telephone or email.

Where end-to-end encryption is used, the content of messages is encrypted and cannot be viewed even by the messenger provider. However, providers can establish that and when communication takes place, and may process technical information about the device used and, depending on your settings, location data.

Services used: Apple iMessage (Apple Inc., Cupertino, USA), Microsoft Teams (Microsoft Ireland Operations Limited, Dublin, Ireland) and WhatsApp (WhatsApp Ireland Limited, Dublin, Ireland). Basis for third-country transfers: EU-US Data Privacy Framework and standard contractual clauses.

For first conversations, advisory sessions and online workshops we use Microsoft Teams. Master and contact data of participants, content data from the meeting and meta and connection data such as IP address, device information and time stamps are processed.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; parent company: Microsoft Corporation, Redmond, USA. The basis for third-country transfers is the adequacy decision under the EU-US Data Privacy Framework together with standard contractual clauses. A data processing agreement is in place with Microsoft.

Recordings are made only where all participants have expressly consented beforehand. The content of our engagements is treated as confidential; our duty of confidentiality applies regardless of the medium used.

Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR), and for recordings consent (Art. 6(1)(a) GDPR).

The application procedure requires applicants to provide us with the data necessary to assess and select candidates. This generally includes personal details such as name, address and contact details, together with evidence of the qualifications required for the position.

Erasure: where an application is unsuccessful, the applicant’s data is deleted. Deletion takes place at the latest six months after the end of the procedure, so that we can answer any follow-up questions and meet our obligations of proof under equal treatment legislation.

LinkedIn Recruiter: job posting and application services within the LinkedIn platform; provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

We use software services accessible via the internet and running on the servers of their providers for the storage and management of content. In this context personal data may be processed and stored on the providers’ servers.

Microsoft cloud services: cloud storage, cloud infrastructure services and cloud-based application software; provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; basis for third-country transfers: EU-US Data Privacy Framework and standard contractual clauses.

We process personal data for the purposes of promotional communication, which may take place through various channels in accordance with legal requirements. Recipients have the right to withdraw any consent given at any time, or to object to promotional communication at any time.

Following withdrawal or objection, we store the data required to demonstrate the previous authorisation for up to three years after the end of the year of withdrawal or objection, on the basis of our legitimate interests. Processing of this data is limited to the purpose of defending against potential claims.

We use no web analytics, no tracking and no audience measurement tools on this website. In particular, neither Google Analytics nor Google Tag Manager nor comparable services are used. No usage profiles are created and no data is transmitted to third parties for analytical purposes.

For the operation of the website, only the server log files described above are collected; these are deleted or anonymised after 30 days at the latest.

We maintain online presences within social networks and process users’ data in this context in order to communicate with users active there or to provide information about us. Users’ data may be processed outside the European Union.

Within social networks, users’ data is generally processed for market research and advertising purposes. Usage profiles may be created on the basis of user behaviour, which in turn may be used to display advertising.

LinkedIn: provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; basis for third-country transfers: standard contractual clauses; objection (opt-out): LinkedIn settings.

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers. Such integration always requires that the third-party provider processes the user’s IP address, since without it the content could not be sent to the user’s browser.

Fonts (served from our own server): this website uses the typefaces Cormorant Garamond and Instrument Sans, both licensed under the SIL Open Font License. The font files are stored on our own server and delivered from there. There is no connection to Google Fonts or any other external font service, and no data is transmitted to third parties; legal basis: legitimate interests (Art. 6(1)(f) GDPR).

This section provides an overview of the terms used in this privacy policy. Where terms are defined by law, the statutory definitions apply.

• ›Personal data: any information relating to an identified or identifiable natural person.
• ›Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• ›Processing: any operation performed on personal data, whether collection, analysis, storage, transmission or erasure.
• ›Audience measurement: the evaluation of visitor flows to an online offering, which may include the behaviour or interests of visitors.
• ›Tracking: following the behaviour of users across several online offerings.