Privacy notice

1. Controller and contact details

The controller responsible for the processing of personal data described here is:

conXisto Consulting GmbH
Kleine Schmiedsgasse 12
96450 Coburg
Germany
Represented by Managing Director Oliver Schaal

For privacy enquiries and to exercise your rights, please contact conXisto Consulting at:
Email: oliver.schaal@conxisto.consulting
Phone: +49 151 4000 7383

2. Scope

This notice covers visits to the conXisto Consulting website and communication with conXisto Consulting by email and telephone. It also applies to the establishment and maintenance of business contacts and related correspondence, regardless of whether the contact originated through this website. This includes, in particular, prospective clients, clients, business partners and their contact persons.

3. Website access and hosting

The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, using its Webhosting product. When you access the website, your browser transmits data to the web server, including your IP address, the requested page or file, the time of access, and information about your browser and operating system.

The data is processed to deliver the content and ensure secure, stable operation. The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR). The legitimate interest of conXisto Consulting is the reliable and secure provision of the website. IONOS processes hosting data on our behalf under Article 28 GDPR.

For Webhosting, IONOS describes the collection of visitor data that is immediately anonymised, including truncated IP addresses, access data, device type and, where applicable, the referring page. According to the provider, this visitor data is retained for eight weeks. IONOS states that this Webhosting visitor data is not transferred to third countries.

Server-side visitor statistics

IONOS Webhosting includes server-side visitor statistics (WebAnalytics). Technical visitor data generated when pages are accessed is processed for statistical analysis and technical optimisation of the website. According to IONOS, no cookies are used and IP addresses are immediately anonymised. Article 6(1)(f) GDPR is the legal basis for the processing prior to anonymisation; the legitimate interest is improving the website to meet visitors’ needs. No additional analytics scripts are embedded in the website code.

Provider information: Data processing by IONOS Webhosting and IONOS WebAnalytics (provider information in German).

4. Fonts, images and storage on your device

Univers font files and images are served together with the website files. The website code does not contact external font or image services to display them.

The website does not set cookies. Its appearance initially follows your device’s light or dark colour scheme. If you explicitly choose a light or dark appearance using the appearance control, only that choice is saved as “light” or “dark” under the key “conxisto-theme” in your browser’s Local Storage. The choice remains until you change it or clear your browser data. Choosing “Auto” removes the saved value. The website code does not transmit this value to our server or third parties and does not use it for identification or analytics. No analytics tools, advertising pixels, embedded maps, videos, social media plugins or contact forms are embedded in the website code. Server-side processing by IONOS is described in Section 3.

5. Email, telephone and business correspondence

conXisto Consulting processes personal data to respond to enquiries and to establish, conduct and maintain business relationships. This includes correspondence about quotations, scheduling, assignments and ongoing business matters. The data processed includes, in particular, your name, role, business contact details, company information, message content, attachments and related communication data. This data is generally provided by you; business contact details may also be supplied by contact persons within your company in the course of working together. During telephone calls, information needed to handle the matter may be noted.

The legal basis is Article 6(1)(b) GDPR where processing relates to a contract with you or steps taken at your request before entering into a contract. Communication with a company’s contact persons and general enquiries are processed under Article 6(1)(f) GDPR. The legitimate interest is responding to and handling business matters appropriately, and organising and maintaining business relationships.

You decide whether to contact us and which information to provide. Without sufficient contact details and information about the matter, conXisto Consulting may be unable to respond to your enquiry. Merely visiting the website does not oblige you to provide contact details.

Data from enquiries and business correspondence is deleted once it is no longer required for the stated purposes and there are no other legitimate grounds for retaining it. Where a contractual relationship follows, the relevant contractual purposes apply. Documents subject to statutory retention requirements are stored for the prescribed periods on the basis of Article 6(1)(c) GDPR. Retention necessary to establish or defend legal claims is based on Article 6(1)(f) GDPR.

conXisto Consulting obtains Microsoft 365 directly from Microsoft and uses the service for business email communication. Message content, attachments and communication data are processed through Microsoft. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Processing on our behalf is governed by the Microsoft Products and Services Data Protection Addendum (DPA), incorporated into the Microsoft Customer Agreement. According to the current information in the admin portal, the Exchange Online content used for email communication is stored at rest in Germany. The Microsoft EU Data Boundary covers EU and EFTA countries and provides for limited exceptions for transfers outside this area. The location of data at rest does not therefore mean that all processing takes place there. Even when European storage regions are used, limited processing outside the European Economic Area, particularly by Microsoft Corporation in the United States and subprocessors, is possible. Microsoft provides safeguards for such transfers, including EU Standard Contractual Clauses. Processing exclusively within Europe is not guaranteed here. Information and contractual safeguards are available in the Microsoft DPA; a copy of the relevant safeguards may be requested using the contact details in Section 1.

6. Recipients and service providers

Within conXisto Consulting, access to personal data is limited to people who need it for the relevant purpose. Technical service providers supporting website operation and communications may process data to the extent necessary to provide their services. The IONOS Webhosting and Microsoft 365 services used are described in Sections 3 and 5.

Data may also be disclosed to competent authorities or other bodies where required by law. This notice does not provide blanket coverage for disclosure for additional purposes.

7. External links

The LinkedIn reference is an ordinary external link. The website does not embed a LinkedIn plugin. You only visit LinkedIn when you follow the link; its privacy notice governs processing there. Email and telephone links open the corresponding application on your device.

8. Your rights

Subject to the applicable legal conditions, you have the right to access your personal data (Article 15 GDPR), rectify inaccurate data (Article 16 GDPR), request erasure (Article 17 GDPR) and restrict processing (Article 18 GDPR).

The right to data portability under Article 20 GDPR applies where its conditions are met, in particular to automated processing based on consent or a contract.

Right to object: Where conXisto Consulting processes your data under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Processing will then cease unless there are overriding compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Please direct your request to the contact details in Section 1. The website code does not carry out automated decisions with legal or similarly significant effects, or profiling.

9. Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with a data protection supervisory authority under Article 77 GDPR, in particular in the country of your habitual residence or place of work, or where the alleged infringement occurred.

For private-sector companies based in Bavaria, the competent authority is generally the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA). Information and the option to lodge a complaint are available at www.lda.bayern.de/de/beschwerde.html.

10. Applications and interest in employment

If you apply to conXisto Consulting or express interest in employment, we process the contact details, professional background, qualifications, messages and documents you provide and, where applicable, information from a professional profile you ask us to review. This allows us to get to know you, assess potential employment and communicate during the application process. The data comes from you or the profile you identify for review.

The legal basis is Section 26(1), first sentence, of the German Federal Data Protection Act (BDSG), in conjunction with Article 88 GDPR. Applicants are included under Section 26(8), second sentence, BDSG. Where necessary to establish or defend legal claims, processing is based on Article 6(1)(f) GDPR; our legitimate interest is documenting a properly conducted application process.

Access is restricted to the people involved in selection. Emails and attachments are processed using Microsoft 365 as described in Section 5, including the service providers and possible international transfers explained there. Contacting us does not by itself authorise us to share your application documents with clients.

Following rejection or withdrawal, application data is erased within six months unless a specific legal dispute or statutory obligation requires longer retention. If you join us, the necessary data is transferred to personnel administration. Longer retention in a talent pool requires your separate, voluntary consent and an agreed retention period. You may withdraw consent at any time with effect for the future.

Contacting us and providing information is voluntary. Without sufficient information, we may be unable to assess your suitability. A brief account of your professional experience is enough for an initial conversation; please avoid sensitive data that is unnecessary for this purpose. There are no solely automated selection decisions. Contact details and your data protection rights are set out in Sections 1, 8 and 9.