Privacy Policy

​

1. Privacy at a glance

What this policy covers
This policy explains which personal data we process when you visit our website, contact us, book a conversation with us or work with us; why we do so and on which legal basis; how long we keep the data; who receives it; and which rights you have. Personal data is any information relating to an identified or identifiable natural person, such as your name, your email address or your IP address.

 

Who is responsible
Conscious Performance GmbH is responsible for the processing described here. Our contact details are set out in section 2.1.

 

How we obtain your data
Part of the data reaches us because you provide it, for example when you complete a form, write to us or book a conversation. Other data is recorded automatically by the technical systems of our website platform when you open a page, mainly technical information such as your browser, your operating system, your IP address and the time of access. Information is stored on or read from your device beyond what is technically necessary only after you have consented.

 

What we use it for
We use your data to provide this website securely and without errors, to answer your enquiries, to arrange and hold conversations, to perform our contracts and, where you have consented, to understand how the website is used so that we can improve it.

 

Your rights in brief
You may at any time and free of charge obtain information about the personal data we hold about you, its origin, its recipients and the purpose of processing. You may have inaccurate data corrected and request erasure or restriction of processing. You may withdraw any consent with effect for the future, object to certain processing and lodge a complaint with a supervisory authority. Details are in section 3.

 

What we do not do
We do not take decisions about you based solely on automated processing. We do not build behavioural profiles of the visitors to this website. We do not sell or rent personal data. We do not use advertising, retargeting or social media tracking tools on this website.

​

2. Controller and general information

2.1 Controller
The controller for the processing of personal data on this website within the meaning of Article 4 (7) GDPR is:
Conscious Performance GmbH
Am Erdbeerstein 1A
61462 Königstein im Taunus, Germany
Managing Director: Miguel Ángel Gurrola Rodríguez
Telephone: +49 172 6172319
Email: info@conscious-performance.com

 

2.2 Data protection officer
Having regard to the size of our firm and the nature of our processing activities, we are not required by Article 37 GDPR or § 38 BDSG to appoint a data protection officer. Please address any question about data protection directly to info@conscious-performance.com.

 

2.3 Legal bases
We process personal data only where the law permits it. The legal bases we rely on are the following, and each section of this policy states which one applies:
•    your consent, Article 6 (1) (a) GDPR, and, where special categories of personal data are concerned, your explicit consent under Article 9 (2) (a) GDPR;
•    the performance of a contract with you or steps taken at your request before entering into a contract, Article 6 (1) (b) GDPR;
•    compliance with a legal obligation to which we are subject, Article 6 (1) (c) GDPR;
•    our legitimate interests or those of a third party, Article 6 (1) (f) GDPR, where these are not overridden by your interests or fundamental rights and freedoms.
Storing information on your device or reading information from it is governed in addition by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). It takes place only with your consent under § 25 (1) TDDDG, unless it is strictly necessary to provide a service you have expressly requested, § 25 (2) no. 2 TDDDG.

 

2.4 Recipients of personal data
Within our firm, your data is accessible only to the persons who need it to deal with your matter. Outside our firm, personal data may be received by the following categories of recipients:
•    service providers who process data on our behalf and under our instructions, bound by a data processing agreement under Article 28 GDPR, in particular our website platform and hosting provider, providers of email, communication and IT services, and providers of video conferencing tools;
•    tax advisers and auditors, who are bound by professional secrecy, where this is necessary to meet our legal obligations;
•    banks, where this is necessary to process payments;
•    public authorities and courts, where we are legally obliged to disclose data.
The individual sections of this policy name the service providers concerned. We do not pass personal data to third parties for their own advertising purposes.

 

2.5 Transfers to countries outside the European Economic Area
Our website platform is operated by Wix.com Ltd., a company based in Israel. The European Commission has decided that Israel ensures an adequate level of data protection (Commission Decision 2011/61/EU, confirmed in the Commission’s review of January 2024), so transfers to Wix in Israel rest on Article 45 GDPR. Wix also stores and processes data in data centres in other countries, including the United States.
Where personal data is transferred to a recipient in the United States that is certified under the EU-U.S. Data Privacy Framework, the transfer rests on the European Commission’s adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Article 45 GDPR). Where a recipient is not certified, or is located in another country without an adequacy decision, the transfer rests on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, Article 46 (2) (c) GDPR). You may request a copy of the safeguards applied by writing to us.
Please note that in countries without an adequacy decision, a level of data protection equivalent to that of the European Union cannot be guaranteed. Public authorities there may, for example, be able to access personal data for security purposes without you having effective legal remedies against this. The sections below state for each service whether data may leave the European Economic Area.

 

2.6 Storage period
Unless a specific period is stated in this policy, we keep your personal data only for as long as is necessary for the purpose for which it was collected. If you validly request erasure or withdraw your consent, we delete the data unless another legal ground requires or permits us to keep it, in particular statutory retention periods under German commercial and tax law (§ 257 HGB, § 147 AO), which generally range from six to ten years. In that case, we restrict the processing of the data to what the retention obligation requires and delete it when the period ends.

 

2.7 Whether you are obliged to provide data
You are under no legal or contractual obligation to provide us with personal data. Some data is, however, required to deal with your matter: without the information marked as mandatory in a form we cannot answer your enquiry or arrange a conversation, and without the data needed for a contract we cannot conclude or perform it. Visiting the website requires the technical data described in section 4.2, without which the pages cannot be delivered to your device.

 

2.8 Security of transmission
This website uses TLS encryption. You can recognise an encrypted connection by the address beginning with “https://” and by the padlock symbol in your browser. With encryption active, the data you send us through the website is protected against being read by third parties while in transit. We also take appropriate technical and organisational measures to protect the data we hold.
Ordinary email is not end-to-end encrypted and can be read or altered on its way across the internet. Please do not send us confidential information by ordinary email; if you need to, contact us first and we will agree a secure channel.

 

2.9 No automated decision-making
We do not subject you to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. This applies equally to our professional work: where we use psychometric instruments, the results are always interpreted by a certified professional, and no decision about a person is taken automatically on the basis of a score (see section 5.2).

 

2.10 Objection to unsolicited advertising
We object to the use of the contact details published in our Imprint for sending advertising or information material that we have not expressly requested, and we reserve the right to take legal action against unsolicited advertising, for example spam email.
 

3. Your rights

 

3.1 Right of access (Article 15 GDPR)
You may ask us to confirm whether we process personal data about you and, if so, to tell you which data, for what purposes, from which source, to which recipients, for how long, and which rights you have. You may also ask for a copy of the data.

3.2 Right to rectification (Article 16 GDPR)
You may ask us to correct inaccurate data about you without undue delay and to complete incomplete data.

3.3 Right to erasure (Article 17 GDPR)
You may ask us to delete your data, in particular where we no longer need it for the purposes for which it was collected, where you withdraw the consent on which processing was based, or where you object and there are no overriding legitimate grounds. This right does not apply where we must keep the data to comply with a legal obligation or to establish, exercise or defend legal claims.

3.4 Right to restriction of processing (Article 18 GDPR)
You may ask us to restrict the processing of your data, so that we only store it, in the following situations:
•    you dispute the accuracy of the data, for the period we need to verify it;
•    the processing is unlawful and you prefer restriction to erasure;
•    we no longer need the data, but you need it to establish, exercise or defend legal claims;
•    you have objected under Article 21 (1) GDPR, for as long as it has not been established whether our legitimate grounds override yours.
While processing is restricted, we may use the data, apart from storing it, only with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

3.5 Right to data portability (Article 20 GDPR)
Where we process data that you have provided to us by automated means on the basis of your consent or of a contract, you may receive it in a structured, commonly used and machine-readable format, or ask us to transmit it directly to another controller where this is technically feasible.

3.6 Right to withdraw consent (Article 7 (3) GDPR)
You may withdraw any consent you have given at any time, with effect for the future, and it is as easy to withdraw consent as to give it. Withdrawal does not affect the lawfulness of the processing carried out before it. Consent to cookies can be withdrawn through the cookie settings (section 4.3); any other consent can be withdrawn by a message to info@conscious-performance.com.

3.7 Right to object (Article 21 GDPR)
WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF ARTICLE 6 (1) (E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THAT PROCESSING; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE LEGAL BASIS OF EACH PROCESSING OPERATION IS STATED IN THIS POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (ARTICLE 21 (1) GDPR).
WHERE WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, INCLUDING SENDING OUR NEWSLETTER, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THAT PROCESSING, INCLUDING PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA FOR THAT PURPOSE (ARTICLE 21 (2) GDPR).

3.8 Right to lodge a complaint (Article 77 GDPR)
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for our registered office is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7, 65185 Wiesbaden, Germany
Postal address: Postfach 31 63, 65021 Wiesbaden, Germany
Telephone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de

3.9 How to exercise your rights
To exercise any of these rights, write to info@conscious-performance.com or to the postal address in section 2.1. Exercising your rights is free of charge. We respond without undue delay and in any event within one month; in complex cases this period may be extended by up to two further months, in which case we will tell you why. Where we have reasonable doubts about your identity, we may ask for information to confirm it before we act.

4. Data processing on this website

4.1 Website platform and hosting
This website is built and hosted on the platform of Wix.com Ltd., 5 Yunitsman St., Tel Aviv, Israel (“Wix”). All data processed when you use the website, including the technical data described in section 4.2 and the content of forms you submit, is stored on servers used by Wix. Wix processes this data as our processor under a data processing agreement pursuant to Article 28 GDPR that forms part of its terms of service.
We use Wix in the interest of a secure, fast and reliable presentation of our website by a professional provider. The legal basis is Article 6 (1) (f) GDPR and, where the website is used to prepare or perform a contract, Article 6 (1) (b) GDPR. Wix stores data in data centres in several countries, including Ireland, Israel and the United States; the safeguards described in section 2.5 apply to these transfers. Further information is available in the privacy policy of Wix at https://www.wix.com/about/privacy.

4.2 Server log files
Each time a page is opened, Wix automatically records in server log files the information your browser transmits: browser type and version, operating system, referring page, host name of the accessing device, date and time of the request, and IP address. We do not combine this data with other data sources.
The data is required to deliver the pages to your device, to keep the website stable and secure, and to detect and defend against attacks. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest lies in the technically error-free and secure operation of the website. Log data is deleted as soon as it is no longer required for these purposes, unless a specific security incident requires it to be kept longer for investigation.

4.3 Cookies and similar technologies
This website uses cookies and comparable technologies. Cookies are small text files stored on your device by your browser. Session cookies are deleted when you close your browser; persistent cookies remain until they expire or until you delete them.
Cookies that are strictly necessary to operate the website and to provide functions you have expressly requested, for example to keep the website secure, to balance server load or to remember your cookie choice, are set on the basis of § 25 (2) no. 2 TDDDG; the subsequent processing of data rests on Article 6 (1) (f) GDPR, our legitimate interest being the technically error-free provision of the website.
All other cookies, in particular cookies used for statistical purposes, are set only with your prior consent under § 25 (1) TDDDG and Article 6 (1) (a) GDPR. You can refuse consent as easily as you can give it, and you can change or withdraw it at any time with effect for the future through the “Cookie settings” link at the foot of every page. The banner shows the categories of cookies used, their purpose and their storage period.
You can also configure your browser to notify you before cookies are set, to accept them only in individual cases, to refuse them entirely, or to delete them automatically when you close the browser. If you disable cookies, some functions of this website may not work fully.

4.4 Consent management
To obtain and record your choices about cookies, we use the consent banner integrated into the Wix platform. When you make or change your choice, the banner stores it in a cookie on your device, together with the date and the version of the settings, so that your decision can be respected on later visits and so that we can demonstrate that consent was given. Your choice is retained until you change it, delete the cookie, or the cookie expires.
The legal basis is Article 6 (1) (c) GDPR in conjunction with Article 7 (1) GDPR, since we are legally obliged to be able to demonstrate consent.

4.5 Fonts
To display text consistently, this website uses web fonts. The fonts are delivered from the servers of our website platform Wix. No connection is established to the servers of Google Fonts or of any other font provider, and no data is transmitted to them.

4.6 Contact form
If you send us a message through a form on this website, we process the details you enter, such as your name, email address, organisation and message, in order to deal with your enquiry and any follow-up questions. The form is provided by Wix (section 4.1), and submissions are stored in our account on the Wix platform.
Where your enquiry relates to a contract or to steps prior to entering into one, the legal basis is Article 6 (1) (b) GDPR. In all other cases, processing rests on our legitimate interest in dealing effectively with the enquiries addressed to us, Article 6 (1) (f) GDPR. We do not pass this data on without your consent unless one of the cases in section 2.4 applies.
We delete the data once your enquiry has been dealt with in full, and enquiries that do not lead to a business relationship at the latest 24 months after our last contact, unless statutory retention obligations require longer storage.
To protect our forms against automated misuse and spam, we use the spam protection integrated into the Wix platform, which evaluates technical information about the submission, such as the IP address and the time of entry. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest lies in protecting the website against abuse.

4.7 Enquiries by email or telephone
If you contact us by email or telephone, we process your enquiry together with the personal data it contains, such as your name, contact details and the content of your request, in order to deal with it. Emails are processed by our email service provider acting as our processor. The legal bases and the storage period are the same as for the contact form (section 4.6).

4.8 Booking a conversation
You can request or book a conversation with us through our website. Bookings are handled with the scheduling function of the Wix platform (Wix Bookings). We process the data you enter, namely your name, email address, telephone number where provided, the date and time you choose and any information you give about the subject of the conversation, in order to arrange and hold the conversation and to send you a confirmation and reminders.
The legal basis is Article 6 (1) (b) GDPR, since the booking serves steps taken at your request prior to a possible contract. Booking data is deleted 12 months after the conversation has taken place, unless it becomes part of a subsequent contractual relationship or statutory retention obligations apply. The transfers described in section 4.1 apply.

4.9 Newsletter
If you subscribe to our newsletter, we need your email address and the information that allows us to verify that you are its holder and agree to receive the newsletter. Any further information is voluntary. We use the double opt-in procedure: your subscription becomes effective only after you confirm it through the link in a confirmation email. To be able to demonstrate your consent, we record the time of registration and confirmation and the IP address used.
The legal basis is your consent, Article 6 (1) (a) GDPR. You can withdraw it at any time through the unsubscribe link contained in every newsletter or by a message to us. After you unsubscribe, we remove your address from the mailing list; we keep the record of your consent for as long as we may need to demonstrate it, on the basis of Article 6 (1) (c) and (f) GDPR. The newsletter is sent with the email marketing function of the Wix platform (section 4.1).

4.10 Downloadable resources
Where we offer documents for download in exchange for your details, we process the data you enter, such as your name, business email address, organisation and role, in order to send you the document you requested. The legal basis is Article 6 (1) (b) GDPR, since this serves a step taken at your request. Subscription to our newsletter is offered separately by a checkbox that is not pre-selected; requesting a document does not subscribe you to anything. Data provided for a download is deleted after 24 months, unless you have separately consented to receive our newsletter.

4.11 Website statistics
To understand how our website is used and to improve it, we use the statistics function integrated into the Wix platform. It records information such as the pages viewed, the time of the visit, the referring website, the type of device and browser, and the approximate location derived from the IP address. The results are made available to us only as aggregated reports; we do not use them to identify individual visitors or to build profiles.
Where this function stores information on your device or reads it from your device, it is used only with your consent under § 25 (1) TDDDG and Article 6 (1) (a) GDPR, which you give and can withdraw through the cookie settings (section 4.3). The transfers described in section 4.1 apply. Statistical data is deleted once it is no longer required for these reports.

4.12 Podcast and links to external platforms
Our podcast is published on Spotify, a service of Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. Our website links to the podcast and to our profiles on Facebook, Instagram, LinkedIn, X and YouTube by means of simple links. No data is transmitted to these providers when you visit our website. Data is transmitted only once you click a link and open the external platform, which then processes your data under its own responsibility and its own privacy policy.
Where an audio or video player of an external platform is embedded on one of our pages, it is not loaded when the page is opened. A placeholder is shown instead, and the player, together with the transmission of your IP address and technical data to the provider, is activated only after your consent under § 25 (1) TDDDG and Article 6 (1) (a) GDPR. Such providers may transfer data to the United States; the safeguards described in section 2.5 apply.

4.13 Our profiles on social networks
We maintain company profiles on social networks. When you visit one of these profiles, the operator of the network processes your data under its own responsibility. For the statistics that the networks LinkedIn, Facebook and Instagram provide to us about the use of our profiles (page insights), we are jointly responsible with the operator under Article 26 GDPR: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (agreement: https://legal.linkedin.com/pages-joint-controller-addendum), and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (agreement: https://www.facebook.com/legal/terms/page_controller_addendum).
Under these agreements, the operator is primarily responsible for informing you about the processing and for enabling you to exercise your rights; you can exercise them directly with the operator, and we will forward any request we receive. We receive the statistics only in aggregated form and cannot identify individual visitors from them. The legal basis for operating our profiles is our legitimate interest in presenting our firm and communicating with the public, Article 6 (1) (f) GDPR. The operators may transfer data to the United States; information on the safeguards used is provided in their privacy policies.

5. Our professional services

5.1 Clients and contract data
We process the personal data of contacts at our clients and of individual clients to the extent necessary to establish, define, perform or change our contractual relationship, on the basis of Article 6 (1) (b) GDPR, and, where the contract is with an organisation, on the basis of our legitimate interest in communicating with its representatives, Article 6 (1) (f) GDPR. We delete the data once the engagement has been completed and the business relationship has ended, subject to statutory retention periods (section 2.6). We pass data to third parties only where this is necessary to perform the contract or where one of the cases in section 2.4 applies.

5.2 Assessment instruments and psychometric data
In our professional engagements we use validated assessment instruments. This processing does not take place on this website: it takes place within the engagement with the organisation concerned or with the individual participant, and it is governed by the relevant contract and, where we act on behalf of an organisation, by a separate data processing agreement. Participants receive specific information before they respond. The following principles apply in every case:
•    Purpose limitation: results serve the development of the person assessed. Before responding, every participant is told for what purpose the result will be used and who will have access to it.
•    Right to feedback: no person is assessed without receiving an individual feedback session on their results, conducted by a certified professional.
•    Human interpretation: results are always interpreted by a certified professional. No decision about a person is taken automatically on the basis of a score.
•    Limited disclosure: results are used only for the agreed purposes. They are shared with third parties, including the commissioning organisation, only to the extent agreed and disclosed to the person assessed before they respond, or with that person’s consent.
•    Explicit consent where required: where an instrument or the circumstances of its use could reveal information concerning health, we process it only with the explicit consent of the person assessed under Article 9 (2) (a) GDPR.
•    Retention and rights: results are kept for the period stated in the engagement and deleted afterwards. The person assessed may exercise the rights described in section 3 at any time.
Conscious Performance GmbH does not distribute or resell assessment instruments. We use them under current professional certification and in accordance with the conditions of use set by their publishers. Where a publisher’s platform processes data on our behalf, a data processing agreement under Article 28 GDPR is in place; where a publisher processes data as an independent controller, participants are informed of this before they respond.

5.3 Online meetings and video conferencing
For conversations, meetings and workshops held online we use video conferencing tools. When you take part, we and the provider of the tool process the data you provide, such as your name and email address, the time and duration of the meeting, the number of participants, technical data such as IP address, device type and operating system, and any content shared in the meeting, such as chat messages and files. We do not record meetings without informing all participants in advance and, where required, obtaining their consent.
The legal basis is Article 6 (1) (b) GDPR where the meeting serves the preparation or performance of a contract, and otherwise our legitimate interest in efficient communication, Article 6 (1) (f) GDPR. Data that we store ourselves is deleted once the purpose has been fulfilled, subject to statutory retention periods; we have no influence on the periods for which providers keep data for their own purposes.
We use Microsoft Teams, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, under a data processing agreement pursuant to Article 28 GDPR. Data may be transferred to the United States; the transfer rests on the certification of Microsoft Corporation under the EU-U.S. Data Privacy Framework and, additionally, on standard contractual clauses (section 2.5).

5.4 Applicants
If you apply to work with us, for example by email, we process the data contained in your application, such as your contact details, application documents and notes from interviews, insofar as this is necessary to decide whether to establish an employment or freelance relationship. The legal basis is Article 6 (1) (b) GDPR, read together with § 26 BDSG where it applies, and, where you have given it, your consent under Article 6 (1) (a) GDPR. Within our firm, your data is passed only to the persons involved in the decision.
If your application is successful, we keep the data for the purpose of the working relationship. If it is not, or if you withdraw it, we keep the data for six months after the end of the procedure, on the basis of our legitimate interest in being able to defend ourselves against legal claims, Article 6 (1) (f) GDPR, and then delete it and destroy any paper documents. We keep the data for longer only if you have consented to this, for example for future vacancies, or if a legal dispute requires it.

5.5 Use of artificial intelligence
We use software, including tools based on artificial intelligence, in our applied research and in the preparation of materials. Technology supports our work; professional judgement decides. No recommendation, psychometric interpretation, diagnostic conclusion or decision about a person is generated or adopted automatically. We do not use emotion recognition or biometric categorisation systems.
Where personal data of clients or participants is processed with an AI tool, we use only services that act as our processor under a data processing agreement pursuant to Article 28 GDPR and that do not use the data to train their models. Results of psychometric instruments relating to identifiable persons are not entered into AI tools. Our use of artificial intelligence takes into account the requirements of Regulation (EU) 2024/1689 (Artificial Intelligence Act).

6. Scope and changes

This policy applies to the website www.conscious-performance.com. Websites to which we link, including those of the Applied Research Institute TCPS SIA, are subject to their own privacy policies. Processing within our professional engagements is governed in addition by the relevant contracts and, where applicable, by separate data processing agreements and participant information.
We review this policy at least once a year and whenever we introduce a new service or change an existing one. The version published on this page applies. Where a change affects processing based on your consent, we will ask for your consent again where required.