Privacy Policy

This privacy policy was last updated on October 8, 2026.

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data with which you can be personally identified.

Data Collection on Our Website

Who is responsible for data collection on this website? Data processing on this website is carried out by the website operator. You can find their contact details in the imprint of this website.

How do we collect your data? Your data is collected partially by you providing it to us. This could include, for example, data you enter in a contact form. Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g., internet browser, operating system, or time of page access).

2. General Information and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Note on the Responsible Party

The responsible party for data processing on this website is: Institute for Business Consulting e.V., Robert-Gerwig-Platz 1, 78120 Furtwangen, Email: vorstand@business-consulting.de

Data Protection Officer

We have appointed a data protection officer:

Yannik Platzek
Robert-Gerwig-Platz 1
78120 Furtwangen
E-Mail: datenschutzbeauftragter@business-consulting.de

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. An informal notification by email to us is sufficient. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

You have the right to revoke consent given to the processing of personal data at any time with effect for the future.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of data protection violations, you have the right to lodge a complaint with the competent supervisory authority. The competent authority is the data protection authority of the federal state in which our association is based (Baden-Württemberg). A list of supervisory authorities and their contact details is available at www.bfdi.bund.de.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, Correction and Deletion

You have the right at any time, within the framework of applicable legal provisions, to free information about your stored personal data, their origin and recipients and the purpose of data processing and, if applicable, a right to correction or deletion of this data.

For this purpose, as well as for further questions on the subject of personal data, you can contact us at any time.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, such as requests that you send to us as the site operator, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

3. Data Collection on Our Website

Cookies

Our websites use so-called "cookies". Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). For more information, please see our Cookie Policy (EU).

Hosting

Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; form emails are also sent via this provider. The servers are located in Germany or the EU. IONOS collects the server log files described above. A data processing agreement (Art. 28 GDPR) is in place with the provider. The legal basis for hosting is our legitimate interest in the secure and reliable provision of the website (Art. 6(1)(f) GDPR).

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

These data are not merged with other data sources.

The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website – for this purpose, server log files must be recorded.

Contact Form

If you send us inquiries via the contact form, your data from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We will not pass on this data without your consent.

The data entered in the contact form is processed on the basis of your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time; an informal e-mail is sufficient. The lawfulness of the processing carried out until the revocation remains unaffected.

The data transmitted via the contact form remains with us until you ask us to delete it, revoke your consent to storage or the purpose for storing the data no longer applies. Mandatory statutory provisions – in particular retention periods – remain unaffected.

Optional: HubSpot CRM. Only if you expressly consent in the contact form do we additionally transfer your details (name, e-mail address, company and phone number if provided, and message) to our HubSpot CRM system operated by HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, in order to process your enquiry better. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by e-mail. A transfer of personal data to the USA cannot be ruled out; it is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified. Without consent your enquiry is sent to us by e-mail only.

Use of our AI chatbot

On our website we offer an automated chatbot based on artificial intelligence (AI) in order to answer enquiries from visitors and members quickly and in a targeted manner. The chatbot is only loaded once you actively open it via the “Questions? Chat with us” button; no data is transmitted to the chatbot before that.

When you use the chatbot, we process the following data:

• Content data: the text messages you enter in the chat window and any information you provide voluntarily (e.g. name or membership number).
• Technical metadata: IP address (in shortened or pseudonymised form), date and time of the request and a temporary session identifier (session ID).

Please do not enter any confidential data or special categories of personal data (such as passwords, bank details or health data) in the chat window.

Purpose and legal basis: the processing serves to answer your enquiries and to provide our online service. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract or membership. In all other cases, the processing is based on our legitimate interest in efficient and timely communication pursuant to Art. 6(1)(f) GDPR.

Service providers and server locations (Microsoft Azure): for the technical operation of the chatbot, database management and provision of the AI language model (LLM) we use cloud services of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (Microsoft Azure). Processing takes place exclusively on servers within the European Union:

• Backend, PostgreSQL database and backups: Azure region North Europe (Ireland).
• AI language model (LLM inference): Azure region Sweden Central (Sweden).

Your input is processed solely to generate the answer and is not used to train the underlying AI models of Microsoft or third parties. We have concluded a data processing agreement (Data Protection Addendum) with Microsoft pursuant to Art. 28 GDPR. Insofar as access by the US parent company (Microsoft Corporation) in the course of support or administration cannot be ruled out, this is based on the EU Commission’s standard contractual clauses and certification under the EU-U.S. Data Privacy Framework.

Storage period: chat histories are stored in our active PostgreSQL database for a maximum of 10 days and then deleted automatically. Data remains in automated system backups for a maximum of 38 days before being irrevocably overwritten as part of the rolling backup cycle.

Local storage in your browser: so that an ongoing conversation is kept when you switch pages, the session identifier is stored in your browser’s local storage. This is strictly necessary for the chat function you have expressly requested (Section 25(2) No. 2 TDDDG). You can delete the identifier at any time using the “New conversation” button in the chat window.

Transparency and non-binding nature: you are communicating with an AI system, not a human (Art. 50(1) AI Act (EU) 2024/1689). The answers are generated automatically, may be incomplete or incorrect and are not binding. For binding information, in particular on membership, projects or terms, please use our contact form or e-mail. No automated decision-making within the meaning of Art. 22 GDPR takes place.

Objection and erasure: insofar as processing is based on our legitimate interest, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). Using the chatbot is voluntary; alternatively, you can reach us at any time by e-mail or via the contact form. On request we will delete your chat history before the end of the storage period – please tell us when the conversation took place.

Technical implementation: the chat window is loaded from our own web server (no external content delivery network). Messages are processed by automation software operated by us (n8n) in the Microsoft Azure environment mentioned above.

Google reCAPTCHA

To protect our contact form against spam, we use the Google reCAPTCHA service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA checks whether the form is filled in by a human or by an automated program (bot).

reCAPTCHA is only loaded if you have given your consent (category “Spam protection (Google reCAPTCHA)” in the cookie banner). From then on, the service analyses behaviour on the page based on various characteristics.

For this purpose, Google reCAPTCHA evaluates, among other things, the IP address, time spent on the page, mouse movements and browser information and sets or reads cookies on your device.

The data collected is transmitted to Google. A transfer of personal data to the USA cannot be ruled out; it is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Without consent the contact form remains locked; you can always reach us by e-mail at vorstand@business-consulting.de.

You can withdraw your consent at any time with effect for the future via the cookie settings.

Further information: Google privacy policy and Google terms of service.

Google Analytics

With your consent (category “Statistics”) we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This tells us how our website is used (e.g. pages viewed, time spent, origin, device type) so that we can improve it. Google Analytics sets cookies (e.g. “_ga”) on your device for this purpose. IP addresses are not logged or stored in Google Analytics 4.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Without consent, Google Analytics is not loaded. The data is stored for a maximum of 14 months. A transfer of personal data to the USA cannot be ruled out; it is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified. You can withdraw your consent at any time with effect for the future via the cookie settings.

Google Maps

On our contact page you can display a Google Maps map (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded once you click “Load map” or have consented to the category “External media”. Your IP address and information about your browser, among other things, are then transmitted to Google; Google may set cookies in the process.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). A transfer of personal data to the USA cannot be ruled out; it is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified. Further information: Google privacy policy.

Instagram posts

On the “For students” page we embed posts (reels) from our Instagram channel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The posts are only loaded once you click a preview or “Load Instagram posts” or have consented to the category “External media”. No data is transmitted to Meta beforehand.

After loading, Meta receives, among other things, your IP address, browser information and the information that you visited our page; if you are logged in to Instagram, Meta can link the visit to your account. Meta may set cookies. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). We are jointly responsible with Meta for the embedding (Art. 26 GDPR). A transfer of personal data to the USA cannot be ruled out; it is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified. Further information: Instagram privacy policy.