Controller
Gunnar Hoyer MPU-Akademie Stadthof 16a 63065 Offenbach am Main Germany Phone: 069-34873291 Email: gunnar.hoyer@mpu-akademie.eu
Types of data processed
- Master data (e.g. names, addresses)
- Contact data (e.g. email, phone numbers)
- Content data (e.g. text entries, photographs, videos)
- Usage data (e.g. websites visited, interest in content, access times)
- Meta/communication data (e.g. device information, IP addresses)
- Contract data (e.g. subject matter of the contract, term, customer category)
- Payment data (e.g. bank details, payment history)
- Special categories of personal data in the context of counselling (e.g. information on alcohol or drug use and on health) – only with your express consent
Purposes of processing
- Provision of the online offering, its functions and content
- Answering contact enquiries and communicating with users
- Scheduling appointments and conducting counselling / coaching
- Providing the digital workbook for our clients and issuing certificates
- Security measures
- Reach measurement / statistics
- Marketing and remarketing
- Contract performance and billing
Terms used
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special characteristics. “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Relevant legal bases
In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Unless the legal basis is expressly stated in this privacy policy, the following applies:
- Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG is the legal basis for processing based on consent (e.g. for cookies that are not technically necessary, statistics and marketing tools, chat services such as Chatbase).
- Art. 6 (1) (b) GDPR is the legal basis for processing to provide our services and carry out pre-contractual and contractual measures and to answer enquiries.
- Art. 6 (1) (c) GDPR is the legal basis for processing to fulfil our legal obligations.
- Art. 6 (1) (f) GDPR is the legal basis for processing to safeguard our legitimate interests (e.g. operation, security and optimisation of our online offering).
- Art. 6 (1) (d) GDPR is the legal basis where vital interests of the data subject or another natural person make processing necessary.
§ 25 TDDDG additionally applies to the storage of information (e.g. cookies) on the user's terminal equipment and access to it.
Security measures
In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk for the data we process. Please inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an action on your part (e.g. renewed consent) or other individual notification.
Cooperation with processors and third parties
If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this is done only
- on the basis of a legal permission (e.g. if transferring the data to payment service providers in accordance with Art. 6 (1) (b) GDPR is necessary to perform the contract),
- on the basis of your consent,
- due to a legal obligation or
- on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).
If we commission third parties to process data on the basis of a “data processing agreement”, this is done on the basis of Art. 28 GDPR.
Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or this happens in the context of using third-party services or disclosing or transferring data to third parties, this is done only if it is done
- to fulfil our (pre-)contractual obligations,
- on the basis of your consent,
- due to a legal obligation or
- on the basis of our legitimate interests
. Subject to legal or contractual permissions, we process or have data processed in a third country only if the special requirements of Art. 44 et seq. GDPR are met. This means that processing takes place, for example, on the basis of
- an adequacy decision of the EU Commission under Art. 45 GDPR (e.g. EU-US Data Privacy Framework for certified US companies) or
- appropriate safeguards, such as standard data protection clauses of the EU Commission (Art. 46 GDPR) and, where applicable, additional protective measures.
Rights of data subjects
You have the right
- under Art. 15 GDPR to request confirmation as to whether data concerning you is being processed, and to obtain information about this data as well as further information and a copy of the data,
- under Art. 16 GDPR to request the completion of data concerning you or the correction of inaccurate data concerning you,
- under Art. 17 GDPR to request that data concerning you be deleted without delay or, alternatively, under Art. 18 GDPR to request restriction of the processing of the data,
- under Art. 20 GDPR to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to request its transfer to other controllers,
- under Art. 77 GDPR to lodge a complaint with the competent supervisory authority.
Right to withdraw consent
You have the right to withdraw consent given in accordance with Art. 7 (3) GDPR with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to object
You can object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. In particular, you can object to processing for direct marketing purposes.
Cookies, consent and tracking technologies
“Cookies” are small files that are stored on users' devices. Various information can be stored in cookies. A cookie primarily serves to store information about a user or the device on which the cookie is stored during or after their visit to an online offering.
- Temporary cookies / session cookies: are deleted after a user leaves an online offering and closes the browser (e.g. to store a login status).
- Permanent cookies: remain stored even after the browser is closed (e.g. to recognise the user or store interests).
- First-party cookies: are set by us as the controller.
- Third-party cookies: are set by providers other than the controller operating the online offering (e.g. by analytics or marketing services).
We may use both temporary and permanent cookies and provide information about this in this privacy policy and in our cookie banner. The legal basis for storing information (cookies) on your terminal equipment and accessing it is generally your consent under § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. Strictly necessary cookies required to operate the website may be used on the basis of § 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR (legitimate interest in a functioning online offering). If you do not want cookies to be stored on your computer, you can deactivate the corresponding option in your browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may restrict the functionality of this online offering. A general objection to the use of cookies for online marketing purposes can be declared for many services, e.g. via the US site https://optout.aboutads.info/?c=2&lang=EN or the EU site https://www.youronlinechoices.com/.
Deletion of data
The data we process is deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data stored by us is deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing deletion. If data is not deleted because it is required for other legally permissible purposes, its processing is restricted (blocked). According to statutory requirements in Germany, data is retained in particular
- for 6 years in accordance with § 257 (1) HGB (commercial books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting records, etc.) and
- for 10 years in accordance with § 147 (1) AO (books, records, management reports, accounting records, commercial and business letters, documents relevant for taxation, etc.).
According to statutory requirements in Austria, data is retained in particular
- for 7 years in accordance with § 132 (1) BAO (accounting documents, receipts/invoices, accounts, business papers, etc.),
- for 22 years in connection with real estate and
- for 10 years for documents in connection with electronically supplied services, telecommunications, radio and television services provided to non-businesses in EU member states (MOSS procedure).
Business-related processing
We additionally process
- Contract data (e.g. subject matter of the contract, term, customer category)
- Payment data (e.g. bank details, payment history)
from our customers, prospective customers and business partners for the purpose of providing contractual services, service and customer care as well as marketing, advertising and market research.
Hosting and technical infrastructure
The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services that we use to operate this online offering. In doing so, we or our hosting provider process master data, contact data, content data, contract data, usage data and meta and communication data of customers, prospective customers and visitors to this online offering on the basis of our legitimate interests in the efficient and secure provision of this online offering in accordance with Art. 6 (1) (f) GDPR in conjunction with Art. 28 GDPR (data processing on behalf).
Hetzner
We use Hetzner for hosting and server services. In particular, IP addresses, server log data, timestamps, requested resources and technical communication data may be processed. The purpose is the secure and reliable operation of our online offering.
Cloudflare
We use Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) for security, CDN and performance functions and to operate our digital workbook (see section “Digital workbook”). In particular, IP addresses, HTTP requests, device/browser information, security events and technical connection data may be processed. The purpose is the secure, stable and fast provision of the website and protection against abusive access. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, we have concluded a data processing agreement with Cloudflare in accordance with Art. 28 GDPR, including standard data protection clauses.
Cloudflare privacy information
NitroPack
We use NitroPack for the technical optimisation and accelerated delivery of our website. Depending on the configuration, technical connection data such as IP address, browser information, requested resources and cache/CDN-related information may be processed.
WordPress / Elementor
Our website is built with WordPress and Elementor. The mere use of the website builder does not automatically mean that data is transferred to Elementor during a normal page visit. However, specifically activated Elementor services or external functions must be taken into account in consent management according to their actual technical use.
Collection of access data and log files
On the basis of our legitimate interests within the meaning of Art. 6 (1) (f) GDPR, we or our hosting provider collect data on every access to the server on which this service is located (so-called server log files). The access data includes:
- name of the website or file accessed
- date and time of access
- amount of data transferred
- notification of successful access (HTTP status code)
- browser type and version
- the user's operating system
- referrer URL (the previously visited page)
- IP address (in shortened form where possible) and the requesting provider
For security reasons (e.g. to investigate misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further retention is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.
Therapeutic services and coaching
We process the data of our clients and prospective clients (collectively “clients”) in accordance with Art. 6 (1) (b) GDPR in order to provide contractual or pre-contractual services. The nature, scope, purpose and necessity of the processing are determined by the underlying contractual relationship. The data processed includes basic master data (e.g. name, address), contact data (e.g. email address, phone number), contract data (e.g. services used, fees, names of contact persons) and payment data (e.g. bank details, payment history). As part of our services, we may process special categories of personal data in accordance with Art. 9 (1) GDPR (e.g. health data, where applicable information on psychological strain, addictive behaviour, etc.). Where necessary, we obtain express consent for this in accordance with Art. 6 (1) (a), Art. 7 and Art. 9 (2) (a) GDPR, or process this data for the purposes of health care in accordance with Art. 9 (2) (h) GDPR in conjunction with § 22 BDSG. Where necessary for the performance of the contract or required by law, we transfer client data to other professionals, third parties involved in the performance of the contract (e.g. billing offices) or comparable service providers, insofar as this serves the provision of our services (Art. 6 (1) (b) GDPR), legal obligations (Art. 6 (1) (c) GDPR), our legitimate interests or those of the clients (Art. 6 (1) (f) GDPR) or the vital interests of the clients or other persons (Art. 6 (1) (d) GDPR). The data is deleted when it is no longer required to fulfil contractual or statutory duties of care or to handle any warranty and comparable obligations. The necessity of retention is reviewed every three years; otherwise the statutory retention obligations apply.
Digital workbook for clients (arbeitsheft.mpu-akademie.eu)
We provide our clients with a digital workbook for MPU preparation at arbeitsheft.mpu-akademie.eu. In it, clients work on questions and homework, see their appointments, upload documents and receive their certificates. For this purpose, clients receive a personal access link and can optionally set a password.
Data processed
- Master and contact data (name, email address, phone number, address, date of birth for certificates)
- Contract and appointment data (booked package, number and dates of counselling sessions, responsible counsellor)
- Content data: answers in the workbook, homework, review questions, uploaded documents and images, certificates
- Special categories of personal data in accordance with Art. 9 (1) GDPR, in particular information on alcohol or drug use, health and traffic offences
- Usage data (days on which the workbook was opened or edited; time of data protection consent)
- Technical data (IP address, browser and device information) as part of server operation
Purposes and legal bases
The processing takes place to carry out the agreed traffic-psychology counselling (Art. 6 (1) (b) GDPR). We process health-related and other special data exclusively on the basis of your express consent (Art. 6 (1) (a), Art. 9 (2) (a) GDPR), which is obtained before the workbook is used for the first time and logged with a timestamp. Without this consent the workbook cannot be used; the counselling itself remains unaffected. Only the responsible counsellor and the management of MPU-Akademie have access to the content. Everyone involved is bound by confidentiality. Certificates are only transmitted to assessment centres, driving licence authorities or courts with your separate consent and release from confidentiality, which you grant in the workbook and can withdraw at any time.
Cookies and local storage
The workbook uses only technically necessary cookies or local browser storage (e.g. login status, selected language, light/dark view, introduction already seen) on the basis of § 25 (2) TDDDG. No analytics, marketing or tracking services are used in the workbook.
Hosting and storage (Cloudflare)
The workbook is operated on the Cloudflare platform. The database with your information and the uploaded documents are stored under EU jurisdiction in data centres within the European Union. In addition, technical connection data is generated when the workbook is accessed (see the Cloudflare section above). Cloudflare acts as our processor in accordance with Art. 28 GDPR.
Data backup
To protect against data loss, we create daily backup copies of the database. These are kept for 30 days and then automatically deleted: on the one hand at Cloudflare in the EU, on the other hand encrypted with AES-256 in our Google Workspace account (Google Drive, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Only we hold the key; Google cannot read the content. The legal basis is our legitimate interest in data security (Art. 6 (1) (f), Art. 32 GDPR).
Appointments and calendar (Google Workspace)
We manage counselling appointments in the Google Calendar of our Google Workspace account. The workbook automatically matches appointments using your email address so that you can see your appointments there and receive reminders. Name, email address and appointment data are processed for this purpose (Art. 6 (1) (b) GDPR). Google acts as our processor; insofar as data is transferred to the USA, this is done on the basis of the EU-US Data Privacy Framework or standard data protection clauses.
Email notifications
The workbook sends appointment reminders, notes on homework and – at your request – certificates by email. They are sent via Cloudflare's email service or our Google Workspace mailbox (Art. 6 (1) (b) GDPR). You can unsubscribe from appointment reminders with your counsellor.
AI-supported functions (Cloudflare Workers AI)
If your counsellor activates them for you, the workbook offers automatic feedback on your answers and an assistant for questions about the procedure and how to use it. Our counsellors also use AI to formulate certificate texts. For this purpose, the text required in each case is transmitted to Cloudflare Workers AI and evaluated there with open-source language models. The content is not used to train AI models and is not stored permanently by the provider. The AI feedback is non-binding assistance; no automated decision within the meaning of Art. 22 GDPR takes place. Use is voluntary and covered by your consent to the use of the workbook (Art. 6 (1) (a), Art. 9 (2) (a) GDPR). Processing may also take place outside the EU; Cloudflare is certified under the EU-US Data Privacy Framework.
Customer management (HubSpot)
We transfer your contact data from the workbook (name, email address, phone number) to our CRM system HubSpot (see section HubSpot) in order to manage enquiries and customer relationships consistently (Art. 6 (1) (b) and (f) GDPR). Your answers in the workbook, health information and documents are not transferred to HubSpot.
Storage period
The data in the workbook is deleted as soon as it is no longer required for counselling and issuing certificates and there are no statutory retention obligations preventing this. The necessity is reviewed at least every three years. You can request the deletion of your data at any time. You can withdraw your consent at any time with effect for the future by email to gunnar.hoyer@mpu-akademie.eu.
Business analyses and market research
In order to run our business economically and to identify market trends and the wishes of customers and users, we analyse the data available to us on business transactions, contracts, enquiries, etc. For this purpose, we process master data, communication data, contract data, payment data, usage data and metadata on the basis of Art. 6 (1) (f) GDPR. Data subjects include customers, prospective customers, business partners and visitors to and users of our online offering. The analyses are carried out for the purposes of business evaluations, marketing and market research. Wherever possible, the data is pseudonymised or anonymised. Personal profiles, if created at all, are deleted or anonymised at the latest when a user account is terminated, otherwise at the latest two years after conclusion of the contract.
Registration function
Users can optionally create a user account. As part of registration, the required mandatory information is provided. The data entered during registration is used for the purposes of using the offering. Users may be informed by email about information relevant to the offering or registration (e.g. changes to the offering or technical circumstances). If users terminate their user account, their data relating to the user account is deleted unless commercial or tax law retention obligations (Art. 6 (1) (c) GDPR) prevent this. It is the users' responsibility to back up their data before the end of the contract. We are entitled to irrevocably delete data stored during the term of the contract if there are no legal obligations preventing this. When our registration and login functions are used and the user account is used, we store the IP address and the time of the respective user action on the basis of our legitimate interests (Art. 6 (1) (f) GDPR) and those of the users (protection against misuse and other unauthorised use). This data is only passed on to third parties if this is necessary to pursue our claims or is required by law (Art. 6 (1) (c) GDPR). IP addresses are anonymised or deleted after 7 days at the latest.
Contacting us
When you contact us (e.g. via contact form, email, phone or social media), the user's information is processed to handle and deal with the contact enquiry in accordance with Art. 6 (1) (b) GDPR (pre-contractual enquiries, contractual relationship) or Art. 6 (1) (f) GDPR (general enquiries). Users' information may be stored in a customer relationship management system (“CRM system”) or comparable enquiry management. We delete enquiries when they are no longer required; the necessity is reviewed regularly, at least every two years. The statutory archiving obligations also apply.
Chatbot / Chatbase
We use a chatbot service on our website to offer you the simplest and quickest possible way of obtaining information (e.g. questions about our services, the MPU preparation process or scheduling appointments). For this we use the “Chatbase” service provided by Chatbase Inc., 2261 Market Street STE 85690, San Francisco CA 94114, USA. The chat is for general information only. Please do not transmit any sensitive data via the chat (e.g. health data, data on criminal offences, information on ongoing proceedings or other special categories of personal data within the meaning of Art. 9 GDPR).
Scope of processing
When using the chat, the following data in particular is processed:
- Content data: chat messages and questions you enter
- Usage and metadata: date and time of use, approximate length of stay, browser and device information where applicable
- IP address (in shortened form where technically possible)
The processing takes place in order to answer your enquiry automatically and to continuously improve the quality of the chat. The evaluation is carried out on our behalf by Chatbase on the basis of a data processing agreement in accordance with Art. 28 GDPR.
Legal basis
Use of the chat is voluntary. Data processing in the context of the chatbot is based on your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG), which is obtained via our consent/cookie management before the chat is activated. Insofar as your enquiry is directly related to an existing contract or the initiation of a contract, the processing may additionally be based on Art. 6 (1) (b) GDPR.
Data transfer to the USA
Chatbase processes data on servers in the USA, among other places. The USA is a third country within the meaning of the GDPR. Data is only transferred if the requirements of Art. 44 et seq. GDPR are met. For this purpose, Chatbase uses in particular the standard data protection clauses issued by the EU Commission and, according to its own information, offers a level of protection in line with the legal requirements. In addition, a transfer may take place on the basis of an adequacy decision under Art. 45 GDPR (EU-US Data Privacy Framework) if Chatbase is certified accordingly.
Storage period
The data generated when using the chat is stored by us only for as long as is necessary to answer your enquiry and to ensure the proper operation of the chatbot, or as long as statutory retention periods apply. Otherwise, the data is deleted or anonymised. You can withdraw your consent to the use of the chatbot at any time with effect for the future via the settings in the cookie/consent tool.
Comments and posts
If users leave comments or other posts (e.g. in the blog), their IP addresses may be stored for up to 7 days on the basis of our legitimate interests (Art. 6 (1) (f) GDPR). This is done for our security in case someone leaves unlawful content in comments or posts (e.g. insults, prohibited political propaganda, etc.). We reserve the right to process users' information for the purpose of spam detection.
Retrieval of profile pictures from Gravatar
Within our online offering we use the Gravatar service provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. Gravatar is a service where users can register and store profile pictures and email addresses. If users leave comments on other online presences (especially blogs) with the respective email address, their profile pictures can be displayed next to the posts. For this purpose, the email address provided by users is encrypted before being transmitted to Gravatar. Gravatar thereby learns the users' IP address, as this is technically necessary for communication between the browser and the online service. Further information on the use of data by Gravatar can be found at: https://automattic.com/privacy/. If you do not want an image stored with Gravatar to be displayed, you should use an email address for commenting that is not stored with Gravatar, or refrain from using our comment system.
Newsletter
The following information explains the content, registration, sending and evaluation procedures of our newsletter and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described.
- Content: information about our services, offers and news about MPU-Akademie.
- Sent only with consent or legal permission (§ 7 UWG).
Double opt-in and logging
Registration for the newsletter takes place in a so-called double opt-in procedure. After registering, you receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with someone else's email address. Registrations are logged in order to be able to prove the registration process in accordance with legal requirements (storage of registration and confirmation time, IP address, any changes to your data).
Registration data
To register, it is sufficient to provide your email address. Optionally, you can provide your name so that you are addressed personally in the newsletter.
Legal basis
The newsletter is sent and its performance measured on the basis of your consent (Art. 6 (1) (a) GDPR, Art. 7 GDPR in conjunction with § 7 (2) no. 3 UWG) or on the basis of the legal permission under § 7 (3) UWG (advertising to existing customers).
Cancellation/withdrawal
You can cancel receipt of our newsletter at any time, i.e. withdraw your consent. You will find an unsubscribe link at the end of each newsletter. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests (Art. 6 (1) (f) GDPR) in order to be able to prove consent previously given. An individual request for deletion is possible at any time, provided you confirm that consent previously existed.
Newsletter – mailing service provider (Mailchimp)
The newsletter is sent by the mailing service provider “Mailchimp” (The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA). You can find the mailing service provider's privacy policy at: https://mailchimp.com/legal/privacy/. Mailchimp is used on the basis of a data processing agreement in accordance with Art. 28 GDPR. Mailchimp uses standard data protection clauses of the EU Commission or other appropriate safeguards to secure data transfers to the USA. Mailchimp may use recipients' data in pseudonymised form, i.e. without assignment to a specific user, to optimise or improve its own services (e.g. technical optimisation of sending). Mailchimp does not use the data for its own advertising purposes.
Newsletter – performance measurement
The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server or that of the mailing service provider when the newsletter is opened. During this retrieval, technical information (browser, system, IP address, time of retrieval) and information about newsletter opens and link clicks is collected. This information is used for the technical improvement of our offering and to optimise the content of the newsletter. The evaluation is carried out in pseudonymised form; it is not our aim to evaluate individual users.
Key external services
Depending on how our website is used, we use in particular Cloudflare, Google Workspace, Google Analytics and Google Ads, Meta/Facebook Pixel, HubSpot, Calendly, Chatbase, Mailchimp and embedded YouTube content. Services that are not technically necessary are – where required by law – controlled via our consent management. The technical configuration actually used is decisive.
Google Analytics
On the basis of your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG), we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google uses cookies. The information generated by the cookie about users' use of our online offering is generally transferred to a Google server in the USA and stored there. We only use Google Analytics with IP anonymisation activated. This means that users' IP addresses are shortened by Google within the EU or the EEA; only in exceptional cases is the full IP address transferred to the USA and shortened there. Google will use this information on our behalf to evaluate the use of our online offering, compile reports on website activity and provide further services related to the use of the online offering. Pseudonymous usage profiles may be created from the processed data. The IP address transmitted by your browser is not merged with other Google data. You can withdraw your consent at any time via our consent tool or prevent the storage of cookies by adjusting your browser software accordingly. You can also prevent the collection of the data generated by the cookie and its processing by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
Google marketing services (e.g. Google Ads, remarketing)
On the basis of your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), we use marketing and remarketing services (“Google marketing services”) of Google Ireland Limited. Google marketing services enable us to display advertisements for and on our website in a more targeted way, so that users are only shown ads that potentially match their interests. For this purpose, Google uses cookies and similar technologies. The information collected by cookies about the use of this website (e.g. pages visited, content clicked, technical information) may be transferred to Google servers in the USA and evaluated there. The data is processed pseudonymously. You can withdraw your consent at any time via our consent tool. You can also deactivate interest-based advertising by Google via the following page: https://adssettings.google.com/.
Facebook pixel, Custom Audiences and Facebook conversion
With your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), our online offering uses the so-called “Facebook pixel” of the social network Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. With the help of the Facebook pixel, Facebook can identify visitors to our online offering as a target group for displaying advertisements (“Facebook ads”). We use the pixel to show Facebook ads only to users who have shown an interest in our online offering or who have certain characteristics (e.g. interest in MPU topics) that we transmit to Facebook (“Custom Audiences”). Via the Facebook pixel, Facebook records, among other things, whether users reached our website after clicking on an ad (so-called “conversion”). The data collected is anonymous to us; however, Facebook may link it to the respective user profile. You can withdraw your consent at any time and make further settings for usage-based advertising in your Facebook settings: https://www.facebook.com/adpreferences/ad_settings/.
HubSpot
We use HubSpot (HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland) to manage contacts with prospective customers and customers – including the contact data from our digital workbook –, to handle enquiries, for forms and communication and – if activated and consented to – to analyse the use of our website. In particular, contact data, form entries, communication content, usage data, device/browser information, online identifiers and IP addresses may be processed. Insofar as HubSpot cookies or similar tracking technologies are used for analysis or marketing purposes, they are activated on the basis of your consent in accordance with Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. For enquiries initiated by you or pre-contractual or contractual measures, Art. 6 (1) (b) GDPR may apply.
Calendly – online appointment scheduling
We use Calendly to schedule counselling appointments. When you make a booking, the information you enter, e.g. name, email address, preferred appointment and any further voluntary information, is processed. In addition, technical data such as IP address, browser/device information and timestamps may be processed. The processing required for scheduling is generally carried out in accordance with Art. 6 (1) (b) GDPR. Calendly also uses cookies and similar technologies. Insofar as these are not technically necessary, they are only loaded when embedded on our website after your consent in accordance with Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
Consent management and Google Consent Mode
We use a consent management system to store and implement your choices regarding cookies, similar technologies and external services that are not technically necessary. A technically necessary storage mechanism may be used for this purpose. Insofar as Google services are used, consent signals may be transmitted to Google via Google Consent Mode. In particular, the states for analytics_storage, ad_storage, ad_user_data and ad_personalization may be taken into account.
Social media presences
We maintain online presences within social networks and platforms (e.g. Facebook, Instagram, YouTube) in order to communicate there with customers, prospective customers and users and to inform them about our services. When the respective networks are accessed, the terms and conditions and data processing policies of the respective operators apply. Unless otherwise stated, we process users' data insofar as they communicate with us within the social networks (e.g. direct messages, comments, posts). The legal basis is our legitimate interest in effective external presentation and communication (Art. 6 (1) (f) GDPR) or your consent (Art. 6 (1) (a) GDPR).
Integration of third-party services and content
On the basis of our legitimate interests (analysis, optimisation and economic operation of our online offering, Art. 6 (1) (f) GDPR), we use content or service offerings from third-party providers within our online offering in order to integrate their content and services (e.g. videos or fonts). This requires the third-party providers to know the users' IP address, as without the IP address they could not send the content to the users' browsers. The IP address is therefore necessary to display the content.
YouTube
We embed videos from the “YouTube” platform of Google Ireland Limited. Privacy information: https://policies.google.com/privacy?hl=de.
Google Fonts
To display fonts consistently, we use so-called “Google Fonts” from Google Ireland Limited. If your browser does not support web fonts, a standard font from your computer is used. Further information: https://developers.google.com/fonts/faq.
Use of Facebook social plugins
On the basis of your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), we use social plugins of the social network Facebook (Meta Platforms Ireland Limited). The plugins can display interactive elements or content (e.g. “Like” button, sharing posts). When a user accesses a function of this online offering that contains such a plugin, their device establishes a direct connection with Facebook's servers. The content of the plugin is transmitted by Facebook directly to the user's device and integrated by it into the online offering. User profiles may be created in the process. The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the related rights and settings options for protecting users' privacy, can be found in Facebook's privacy policy: https://www.facebook.com/privacy/policy.
Date of this privacy policy
Last updated: October 2026 As our website evolves or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version is always available at this URL.